OphanimFlow
OphanimFlow is a free, GPL-3.0 toolkit for collecting, classifying, and preprocessing NetFlow, IPFIX, and sFlow data.
What OphanimFlow is
OphanimFlow is a free, GPL-3.0 toolkit for collecting, classifying, and preprocessing NetFlow, IPFIX, and sFlow data. It graphs bandwidth for each host and provides traffic accounting, making it relevant to ISP management, bandwidth monitoring, traffic analysis, and visualization. NetFlow/IPFIX and sFlow collectors can operate together while sharing network settings and database tables. A web interface is used to configure networks and start the service. Its REST API can return PNG traffic graphs with controls for IP address, direction, period, and image size. The gettraff endpoint reports upload and download totals for all hosts or one IP, with optional year and month filters, and processed data or graphs can feed external applications. Setup instructions cover FreeBSD 14.4, 15.0, and 15.1 plus Debian 13.0 trixie. It runs through API, Linux, self-hosted, and web environments. API endpoints require no authorization by default, while ENDPOINTS_HOSTS can limit receiving host IPs.
Good
- Collects NetFlow, IPFIX, and sFlow
- Collectors share configuration and database tables
- REST API returns graphs and traffic totals
- Supports FreeBSD and Debian setup
- Free and GPL-3.0 licensed
Watch out
- API endpoints have no authorization by default
- Initial credentials are admin and demo
- Documented defaults use UDP ports 42112 and 6343
- Requires self-hosted setup
Who it suits
It suits network administrators, ISPs, and teams needing host-level bandwidth graphs or traffic totals. Self-hosted deployments and external applications can use its API.
Verdict
OphanimFlow combines flow collection, host bandwidth visualization, and traffic accounting with an API for external use. Review its unauthenticated endpoint behavior and self-hosted requirements before deployment.
The facts
Each one read from OphanimFlow's own pages, with the date it was checked.
What it does
- API access
- The README says API endpoints are accessible without authorization and describes an ENDPOINTS_HOSTS option to restrict which host IPs can access them.checked 11 Oct 2026
- Collector defaults
- The documented default NetFlow UDP port is 42112, the sFlow port is 6343, and the sampling rate is 100.checked 4 Oct 2026
- Collectors
- NetFlow/IPFIX and sFlow collectors can run simultaneously and share network configuration and database tables.checked 11 Oct 2026
- Data retention
- Since release 0.0.5, OphanimFlow automatically rotates and flushes old data, reserving 10% of total storage by default.checked 11 Oct 2026
- External use
- The README says the REST API can provide preprocessed data and graphs for use in external apps.checked 4 Oct 2026
- Graph API
- The REST API can return traffic graphs as PNG images, with options for IP address, direction, time period and image dimensions.checked 4 Oct 2026
- Initial credentials
- The setup instructions give the default login as admin and password as demo, and advise changing the password in user profile settings.checked 4 Oct 2026
- Installation
- The README provides batch setup instructions for FreeBSD 14.4/15.0/15.1 and Debian 13.0 trixie.checked 11 Oct 2026
- Intended use
- The README describes OphanimFlow as a replacement for bandwidthd and Stargazer cap_nf for network traffic collection and visualization.checked 11 Oct 2026
- License
- The repository identifies the project as GPL-3.0 licensed.checked 11 Oct 2026
- Purpose
- OphanimFlow collects, classifies, and visualizes NetFlow, IPFIX, and sFlow traffic for hosts on specified networks.checked 11 Oct 2026
- REST API
- The REST API provides graph images and traffic-summary data for use in external applications.checked 11 Oct 2026
- Supported setup systems
- The README provides batch setup instructions for FreeBSD 14.4/15.0/15.1 and Debian 13.0 trixie.checked 4 Oct 2026
- Traffic accounting
- The toolkit provides bandwidth graphs and basic traffic accounting for each host.checked 11 Oct 2026
- Traffic summary API
- The gettraff endpoint returns upload and download byte totals for all hosts or a specified IP, with optional year and month parameters.checked 4 Oct 2026
- Web interface
- After setup, a web interface lets users specify networks and make minimum settings; the README says to change the default admin password in profile settings.checked 11 Oct 2026
Alternatives to OphanimFlow
- 1
ntopng
Free planOpen sourceWebAPILinuxmacOS8.3€299.95 one-time - 2
GlassWire
Free planAndroidWebWindows7.9From $2.99 a month - 3
NetBalancer
Free planWebAPIWindows7.5$34.95 one-time - 4
Sniffnet
Free planOpen sourceLinuxmacOSWindows7.4Free plan - 5
ManageEngine NetFlow Analyzer
Free planAndroidiOSWebLinux7.1From $172 a month - 6
sFlowTrend
Free planWebAPILinuxmacOS7.1Free plan