Monitoring and logs

nfdump

Also nfcapd, flow collector, top talkers

Lists, filters and ranks the flow records a collector (nfcapd) has stored.

nfcapd receives NetFlow, IPFIX or sFlow and writes the records to a new file every few minutes (5 seconds in the lab). nfdump reads them: -R DIR for every file, a filter in a tcpdump-like language, and -s for statistics: the top sources, destinations or ports by flows, packets or bytes.

nfdump command usage

nfdump -R DIR [-q] [-o FORMAT] ['FILTER']
nfdump -R DIR -s FIELD/ORDER [-n N] ['FILTER']

Options

-R /var/netflow: read every file in the directory
-s srcip/bytes: rank source addresses by bytes (also dstip, dstport, proto; flows, packets)
-n 5: the top five
-q: no header or summary
-o extended: more fields per record: TCP flags, bps, bpp
-o 'fmt:%sa %dp': only the fields you name
'src host 10.0.1.12 and dst port 80': a filter; also net, proto, flags, packets > N, bytes > N

nfdump examples

nfdump -R /var/netflow -s srcip/bytes -n 5: Lists the five sources that sent the most bytes.
nfdump -R /var/netflow -s dstport/flows -n 5: Lists the five ports with the most flows.
nfdump -R /var/netflow -q 'src host 10.0.1.12': Lists every record sent from 10.0.1.12.
nfdump -R /var/netflow -o extended 'flags S and not flags A': Lists bare SYNs with their TCP flags: scan probes.

Reading the output

$ nfdump -R /var/netflow -s srcip/flows -n 2
Top 2 Src IP Addr ordered by flows:
Date first seen                 Duration Proto       Src IP Addr    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp
2026-10-01 20:23:30.379     00:00:38.503 any         10.0.2.10      212(47.5)      579(42.5)    29329( 0.1)       15     6093    50
2026-10-01 20:26:06.342     00:00:00.081 any         10.0.1.12      206(46.2)      209(15.3)     9220( 0.0)     2580   910617    44

Flows, Packets, Bytes: totals for that address, with its share of all records.
bpp: bytes per packet. Around 44 with one packet per flow: bare SYNs, a scan.
Records are one-way: a download puts the server on top of srcip; rank dstip to find who received it.

Pitfalls

nfcapd keeps writing to a file it has not closed yet: the newest records appear only after its rotation interval.

Run it on real machines