EVERYTHING XIAOMI
Get listed

nfdump

nfdump is a free, BSD-licensed suite for collecting, processing, and analyzing network flow data in self-hosted Linux deployments.

Place
#17 of 26
Score
5.8
nfdump's website

What nfdump is

nfdump is a free, BSD-licensed suite for collecting, processing, and analyzing network flow data in self-hosted Linux deployments. It collects NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow, and can convert live or PCAP-file traffic into flow data. Analysis tools provide tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can enrich records with geolocation, autonomous-system, and Tor exit-node information. Output formats include text, CSV, JSON, and user-defined formats. The suite includes collector and processing tools such as nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files can use LZO, LZ4, ZSTD, or bzip2 compression; ZSTD and bzip2 require system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and the project is compatible with NfSen. Root privileges are not required unless binding to ports below 1024. nfcapd has no built-in access control, so host-level security should filter source IP addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer; legacy 1.6.x files may require conversion.

Good

  • Collects NetFlow, IPFIX, and sFlow data
  • Converts live or PCAP-file traffic into flow data
  • Outputs text, CSV, JSON, or custom formats
  • Root privileges are unnecessary except for low ports
  • BSD-licensed and free

Watch out

  • nfcapd has no built-in access control
  • ZSTD and bzip2 compression require system libraries
  • Legacy 1.6.x files may need conversion

Who it suits

nfdump suits network operators who need to collect and analyze flow data on Linux in a self-hosted deployment. It may be useful where filtering, aggregation, flow statistics, or metric export are needed.

Verdict

nfdump covers flow collection, filtering, enrichment, and output formats in a self-hosted Linux suite. Its access-control and legacy-file constraints are worth considering during deployment or migration.

Plans and prices

From nfdump's own pricing page, checked 8 Oct 2026.

All about pricing
PlanPriceWhat it gives you
Free / BSD-licensed softwareFreeNo paid plans or usage limits stated

The facts

Each one read from nfdump's own pages, with the date it was checked.

What it does

Compatibility limit
nfdump 1.7.x reads files created by nfdump 1.6.18 or newer, while legacy 1.6.x files may need conversion and only nfdump can read them directly.checked 8 Oct 2026
Compression
Collected files can use LZO, LZ4, ZSTD, or bzip2 compression; ZSTD and bzip2 require system libraries.checked 8 Oct 2026
Enrichment
Flow records can be enriched with geolocation, autonomous-system, and Tor exit-node information using optional databases.checked 8 Oct 2026
Filtering and aggregation
It supports tcpdump-like flow filtering, user-defined aggregation, and flow statistics.checked 8 Oct 2026
Included tools
The suite includes collector and processing tools such as nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay.checked 8 Oct 2026
Integrations
The project documents metric export through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and says it is compatible with NfSen.checked 8 Oct 2026
License
The project is distributed under a BSD license.checked 8 Oct 2026
Output
Supported output formats include text, CSV, JSON, and user-defined formats.checked 8 Oct 2026
Privileges
Root privileges are not required unless binding to ports below 1024.checked 8 Oct 2026
Protocol support
It collects NetFlow versions 1, 5, 7, 9, IPFIX, and sFlow data.checked 8 Oct 2026
Purpose
nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices.checked 8 Oct 2026
Security
The documentation says nfcapd has no built-in access control, so host-level security should filter source IP addresses.checked 8 Oct 2026
Support
The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions.checked 8 Oct 2026
Traffic conversion
It can convert live or PCAP-file traffic into flow data.checked 8 Oct 2026

Alternatives to nfdump

All alternatives
  1. 1ntopng logo

    ntopng

    Free planOpen sourceWebAPILinuxmacOS
    8.3€299.95 one-time
    Visit
  2. 2ManageEngine NetFlow Analyzer logo

    ManageEngine NetFlow Analyzer

    Free planAndroidiOSWebLinux
    7.1From $172 a month
    Visit
  3. 3ElastiFlow logo

    ElastiFlow

    Free planWebAPILinuxSelf-hosted
    6.9Free plan
    Visit
  4. 4

    FlowViewer

    Free planWebLinux
    6.8$500 one-time
    Visit
  5. 5

    SparrowIQ

    AndroidiOSWebWindows
    6.6
    Visit
  6. 6

    Plixer Scrutinizer

    WebAPISelf-hosted
    6.5From $12,996 a year
    Visit