Argus vs nfdump
Argus
openargus.orgnfdump
github.comSide by side
| Figure | Argus | nfdump |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 1 |
| Spec score · Network Traffic Analysis Software | 7.8 (#9) | 7.5 (#15) |
| Integrations | The clients can use InterNIC country-code databases and can be configured to use MaxMind GeoIP libraries and databases. | The project documents metric export through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and says it is compatible with NfSen. |
| License | Argus is released under GPLv2, and the maker invites inquiries about other licensing options. | The project is distributed under a BSD license. |
| Purpose | Argus is an open source network audit system that generates flow records from network traffic. | nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices. |
| Support | The project provides announcement and development mailing lists and directs users to mailing lists or QoSient for contact. | The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions. |
Plans
In their own words
nfdump
nfdump is free BSD-licensed software for collecting, processing, and analyzing network-flow data in Linux self-hosted deployments. It handles NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow versions 4 and 6, and can convert live or PCAP-file traffic into flow data. Analysis includes tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node details. Results can be written as text, CSV, JSON, or user-defined formats. The suite includes nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 need system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and compatibility with NfSen is documented. Root privileges are unnecessary unless binding below port 1024. nfcapd has no built-in access control, so host-level filtering should protect source addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer.