Akvorado vs nfdump
Akvorado
akvorado.netnfdump
github.comSide by side
| Figure | Akvorado | nfdump |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 1 |
| Spec score · Network Traffic Analysis Software | 8.1 (#4) | 7.5 (#15) |
| Enrichment | It uses SNMP for exporter and interface details and supports geographic information from IPinfo or MaxMind. | Flow records can be enriched with geolocation, autonomous-system, and Tor exit-node information using optional databases. |
| License | Akvorado is licensed under AGPLv3. | The project is distributed under a BSD license. |
| Purpose | Akvorado collects network flows, enriches them with metadata, and provides a web interface to explore the data. | nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices. |
| Support | The project directs users to its documentation and GitHub Discussions for help, and asks them to read troubleshooting guidance before opening a discussion. | The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions. |
Plans
In their own words
Akvorado
Akvorado is free network-flow software that receives NetFlow, IPFIX, and sFlow records, enriches them, and exposes the results through a web interface. Its inlet forwards incoming flows to Kafka. The outlet parses and augments them before sending data to ClickHouse. SNMP can supply exporter and interface details, while IPinfo or MaxMind can add geographic information. Optional BGP routes received through BMP contribute AS numbers, AS paths, and communities. A Grafana plugin is available, and the inlet, outlet, orchestrator, and console expose HTTP metrics. Written in Go, Akvorado is delivered as a single binary or Docker image, but deployment requires Kafka and ClickHouse. Recommended resources are 8 vCPUs, 100 GB disk, and 16 GB RAM, with AMD64 or ARM64 listed. The console expects an authenticating proxy to provide user headers. Relational data can use SQLite, MySQL, or PostgreSQL; without one, data remains in memory and disappears on restart. Downgrades are unsupported. The license is AGPLv3.
nfdump
nfdump is free BSD-licensed software for collecting, processing, and analyzing network-flow data in Linux self-hosted deployments. It handles NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow versions 4 and 6, and can convert live or PCAP-file traffic into flow data. Analysis includes tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node details. Results can be written as text, CSV, JSON, or user-defined formats. The suite includes nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 need system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and compatibility with NfSen is documented. Root privileges are unnecessary unless binding below port 1024. nfcapd has no built-in access control, so host-level filtering should protect source addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer.