FlowViewer vs nfdump

FlowViewer is free software for analyzing NetFlow data exported by an organization’s network devices. Its interface works with Carnegie Mellon’s SiLK software and also supports the older flow-tools collector. The toolset combines FlowViewer for text reports, FlowGrapher for charts, and FlowMonitor for longer-term traffic monitoring. It supports NetFlow versions 5 and 9, including IPv6, and offers filtering by address, port, interface, autonomous system, TOS, TCP flags, protocol, and next hop. More than 30 reports are available, and reports and filters can be saved. FlowGrapher charts bits, flows, and packets per second over a selected period; FlowMonitor provides RRD graphs for filtered traffic, with views from 24 hours to 3 years. Dashboards can give groups such as Security and Operations separate live views. FlowViewer is listed for Linux and web use and can be installed on a dedicated Unix server or virtual appliance; the software requires a Unix server. The free plan is free. Paid options include hourly support at a price agreed with the maker, router configuration at $500, paid once, training at $500, paid once, and installation at $750, paid once.

nfdump is free BSD-licensed software for collecting, processing, and analyzing network-flow data in Linux self-hosted deployments. It handles NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow versions 4 and 6, and can convert live or PCAP-file traffic into flow data. Analysis includes tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node details. Results can be written as text, CSV, JSON, or user-defined formats. The suite includes nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 need system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and compatibility with NfSen is documented. Root privileges are unnecessary unless binding below port 1024. nfcapd has no built-in access control, so host-level filtering should protect source addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer.