nfdump on Ubuntu 24.04 LTS

Overview

nfdump is the de-facto open source toolkit for collecting and analysing NetFlow, IPFIX and sFlow traffic data. nfcapd, the always-on collector, listens for flow exports from routers, switches and firewalls and writes them to compact per-interval capture files; the nfdump command line tool then queries that archive with a fast, tcpdump-like filter language. Companion tools round out the toolkit: nfreplay resends captured flows to another collector, nfanon anonymises exporter and endpoint addresses for safe sharing, nfexpire manages retention by age or total volume, and nfpcapd converts raw packet captures into flow records. It is the collector behind most open flow-analysis stacks and a long-standing staple for network operations centres and internet service providers doing traffic visibility, capacity planning and security investigation.

A flow collector earns its keep by simply being there and being current: this image runs nfcapd as a managed systemd service the moment it boots, so routers and switches can be pointed at it immediately, and the archive it builds becomes the record you query when you need to understand what actually crossed the network.

Common uses

• Collect NetFlow, IPFIX and sFlow exports from routers, switches and firewalls
• Investigate traffic patterns, capacity and security incidents from a queryable flow archive
• Centralise flow visibility for a NOC or ISP without deploying a full commercial NMS