Skip to content
SPECIFICTION
Get listed

nfdump

github.com

Free plan LinuxSelf-hosted
Visit github.com
Spec score 7.5 #15 of 26 in Network Traffic Analysis Software

What it is

nfdump is free BSD-licensed software for collecting, processing, and analyzing network-flow data in Linux self-hosted deployments. It handles NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow versions 4 and 6, and can convert live or PCAP-file traffic into flow data. Analysis includes tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node details. Results can be written as text, CSV, JSON, or user-defined formats. The suite includes nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 need system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and compatibility with NfSen is documented. Root privileges are unnecessary unless binding below port 1024. nfcapd has no built-in access control, so host-level filtering should protect source addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer.

Spec sheet

Purpose
nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices.Read 8 Oct 2026 · github.com
Integrations
The project documents metric export through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and says it is compatible with NfSen.Read 8 Oct 2026 · github.com
Security
The documentation says nfcapd has no built-in access control, so host-level security should filter source IP addresses.Read 8 Oct 2026 · github.com
Support
The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions.Read 8 Oct 2026 · github.com
License
The project is distributed under a BSD license.Read 8 Oct 2026 · github.com
Compatibility limit
nfdump 1.7.x reads files created by nfdump 1.6.18 or newer, while legacy 1.6.x files may need conversion and only nfdump can read them directly.Read 8 Oct 2026 · github.com
Compression
Collected files can use LZO, LZ4, ZSTD, or bzip2 compression; ZSTD and bzip2 require system libraries.Read 8 Oct 2026 · github.com
Enrichment
Flow records can be enriched with geolocation, autonomous-system, and Tor exit-node information using optional databases.Read 8 Oct 2026 · github.com
Filtering and aggregation
It supports tcpdump-like flow filtering, user-defined aggregation, and flow statistics.Read 8 Oct 2026 · github.com
Included tools
The suite includes collector and processing tools such as nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay.Read 8 Oct 2026 · github.com
Output
Supported output formats include text, CSV, JSON, and user-defined formats.Read 8 Oct 2026 · github.com
Privileges
Root privileges are not required unless binding to ports below 1024.Read 8 Oct 2026 · github.com
Protocol support
It collects NetFlow versions 1, 5, 7, 9, IPFIX, and sFlow data.Read 8 Oct 2026 · github.com
Traffic conversion
It can convert live or PCAP-file traffic into flow data.Read 8 Oct 2026 · github.com

Plans and prices

Free / BSD-licensed software Free No paid plans or usage limits stated Read 8 Oct 2026 · github.com

Every nfdump plan and price →

Strong points and limits

Strong points

  • Free BSD-licensed software
  • Supports NetFlow, IPFIX, and sFlow
  • Converts live or PCAP traffic
  • Text, CSV, and JSON output
  • InfluxDB and Prometheus export paths

Limits

  • Linux self-hosted deployment
  • nfcapd lacks built-in access control
  • Some compression needs system libraries
  • Legacy 1.6.x files may need conversion

Who it suits

nfdump suits Linux operators running self-hosted flow collection and analysis. It is useful where multiple flow protocols, export formats, enrichment, and monitoring integrations are needed.

Verdict

nfdump offers a broad toolkit for collecting and examining network flows, with filtering, enrichment, compression, and export options. Deployment requires attention to host security, library requirements, and file-version compatibility.

Where Specifiction places it

Alternatives to nfdumpAll alternatives →