nfdump review
A focused Linux toolkit for collecting, filtering, and analyzing network flow records.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
nfdump is an open-source suite for collecting, processing, filtering, aggregating, and analyzing network flow data. It is designed for network operators and administrators managing flow data on their own infrastructure, with Linux and on-premises deployment. The suite includes collectors such as nfcapd and sfcapd, the nfdump processing utility, and supporting tools for anonymization, expiration, replay, geolocation, and Tor-exit-node lookups. It handles NetFlow v1, v5, v7, and v9, IPFIX, and sFlow v4 and v6.
Its main strength is the breadth of flow-processing operations available from a command-line workflow. nfdump can convert live or PCAP traffic into flow data, apply tcpdump-like filters, aggregate records by configurable elements, and generate statistics for IPs, ports, protocols, bytes, packets, and rates. Bidirectional analysis supports connection-level review, while enrichment can add geolocation, autonomous system, and Tor-exit-node information. Collected files can be compressed with LZO, LZ4, ZSTD, or bzip2, then exported as text, CSV, JSON, or user-defined formats.
The published product details position nfdump as a focused infrastructure component rather than a broad monitoring application. Integrations with NfSen, InfluxDB, and Prometheus can connect its flow data to established analysis or monitoring workflows. Its file-based storage and Linux command-line operation suit teams that want direct control over collection and processing, but require administrators comfortable with on-premises tooling. Choose nfdump for lightweight, open-source flow collection, filtering, and analysis; consider another category tool if the priority is a general application-identification experience or a broader interface-led monitoring platform.
nfdump pros and cons
- Where it wins
- Supports NetFlow, IPFIX, and sFlow collection
- Converts live or PCAP traffic into flow data
- Exports text, CSV, JSON, and custom formats
- Where it doesn't
- Linux-only deployment
- Command-line workflow requires technical administration
- Focused on flow records rather than general application identification
nfdump fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update