Caligare Flow Inspector

Caligare Flow Inspector is a self-hosted Linux analyzer for NetFlow exports, using the routers you already have rather than requiring separate probes. It suits network administrators who want browser-based traffic visibility and control over a small or enterprise deployment. The free edition is a sensible non-commercial starting point, but its tight device, retention, and throughput ceilings quickly matter.

Overview

Flow Inspector receives NetFlow versions 1, 5, 6, 7, and 9 from existing routers and turns them into real-time views, traffic statistics, and investigation tools. Because collection and administration run on your own Linux server, it fits organizations that prefer on-premises control and can manage the underlying host and database. Caligare, founded in 2004 and headquartered in Prague, presents the product in editions for individual non-commercial monitoring, smaller businesses, and enterprises.

The browser interface is a practical center for configuring collectors, network devices, application groups, and anomaly detection. That approach avoids deploying probes throughout the network, although it still depends on routers exporting usable flow data.

Key features

Analysis covers top hosts, protocols, applications, and conversations, alongside user data tracking and bandwidth and interface-utilization views. Low-level traffic search, filtering, forwarding, utilization maps, and real-time analysis give an administrator several ways to move from an overall traffic spike to the devices and conversations responsible.

Caligare positions the analyzer as an aid for spotting suspicious activity, denial-of-service attacks, worm-infected stations, bottlenecks, and routing trouble. These indicators can focus an investigation; they are not a substitute for diagnosing or remediating the underlying incident.

Authentication can be local, LDAP, or external, with user and group management included in the free edition. That makes the product more suitable for shared administration than a single-operator tool. Professional and Enterprise add longer-term historical trends, network anomaly detection, unrestricted NetFlow parsing, and commercial use. Those additions are significant when a 24-hour window cannot support capacity planning, incident review, or business operations.

Caligare says Flow Inspector met the requirements for Cisco's Technology Developer Program and is distributed with a Cisco Compatible logo, a useful signal for environments centered on Cisco equipment.

Pricing

Caligare Flow Inspector Free Edition — free. This is for non-commercial use, up to two devices, with 24-hour history and a maximum of 250 flows per second. It includes the core protocol support, searches, utilization views, forwarding, and authentication features. The device and throughput caps make it appropriate for a home lab or very small non-commercial network, not a growing business or sustained high-volume collector. One year of technical support for the free version can be purchased separately online.

Professional edition — custom pricing. It supports one to nine monitored devices and commercial use, while adding longer-term trends, anomaly detection, and unrestricted parsing. This is the natural tier for a small business that has outgrown the free edition's legal and capacity limits.

Enterprise edition — custom pricing. It allows unlimited monitored devices and includes the paid-edition additions. Choose it when a larger organization needs commercial deployment across an unrestricted device estate.

A 30-day trial license key can be requested; Caligare sends the key by email. That gives prospective commercial users time to assess fit before committing to custom-priced licensing.

Platforms

Flow Inspector is self-hosted and web-based on Linux. Caligare provides packages for Debian, RedHat, Fedora, SuSE, and other Linux distributions. The latest version requires MySQL 5.1 or newer, so deployment includes maintaining a compatible database as well as the collector and web service.

Who it's for

Choose it for non-commercial monitoring of one or two devices, a Linux-administered small business installation, or an enterprise that needs router-based flow analysis without installing probes. It is less suitable when you need a cloud service, broad desktop and mobile clients, or a free commercial deployment with more than two devices and more than one day's history.

Pros and cons

Pros

• Uses existing router exports, avoiding a separate probe rollout.
• Real-time analysis reaches hosts, applications, protocols, conversations, and interfaces, supporting targeted bandwidth investigations.
• Browser administration plus LDAP or external authentication and group management suit shared network operations.
• Free support for NetFlow 1, 5, 6, 7, and 9 and includes useful search, mapping, filtering, and forwarding tools.
• Paid editions add the retention and parsing capacity needed for commercial and longer-term work.

Cons

• The free edition is non-commercial, limited to two devices, retains only 24 hours, and caps intake at 250 flows per second.
• Professional and Enterprise pricing is custom, making budgeting less predictable.
• Linux and MySQL requirements place server administration on the customer.
• Threat visibility supports investigation but does not guarantee diagnosis of an attack or routing fault.

Alternatives

ntopng is a stronger alternative when you need broader platform coverage, including Windows and macOS, alongside Linux, web, API, and self-hosted options; its Community edition is free and aimed at small networks.

ManageEngine NetFlow Analyzer fits teams that want a commercial product with published interface-based tiers, including a free two-interface edition and paid monthly plans.

FlowViewer is worth considering if free Unix-server software is the priority and you are comfortable arranging hourly support separately.

Nagios XI is a better direction for broader infrastructure monitoring rather than a NetFlow-focused deployment.

ElastiFlow suits users seeking a free tier with higher stated record throughput, SNMP device coverage, dashboards, and machine-learning detections.

Riverbed Aternity is an enterprise digital-experience offering for organizations seeking that wider scope.

nfdump is the leaner choice for free, BSD-licensed Linux flow processing without stated paid plans or usage limits.

Akvorado is another free self-hosted option, developed by French ISP Free.

Browse the Network Traffic Analysis Software category for more choices.

Verdict

Caligare Flow Inspector is a good pick for Linux-based administrators who want router-fed, web-managed NetFlow analysis and can fit within the free edition's two-device, 24-hour, and 250-flows-per-second boundaries.