# nfdump

nfdump is a Network Detection and Response product. It runs on-premises. Pricing is free.

A toolset for collecting and processing netflow/ipfix and sflow data from netflow/sflow compatible devices.

Checked October 2026.

## What is nfdump?

nfdump is a toolset for collecting and processing netflow/ipfix and sflow data, sent from netflow/sflow compatible devices. It contains several collectors to collect flow data and can process and list flows in many different output formats, creating a wide range of statistics. It also has a powerful flow filter and can aggregate flows according to a user-defined number of elements.

nfdump can enrich the listing of flows with geo location information and AS information, and can read and write flow files in various formats. It is compatible with nfdump-1.6.18 and can read files created with earlier versions.

nfdump is now a multi-threaded program and uses parallel threads for reading, writing, and processing flows, as well as for sorting. It supports flexible length fields for netflow v9 and IPFIX, and has improved packet processing with nfpcapd.

nfdump has new programs such as geolookup, which allows enriching IP addresses with country codes/locations and adding potential missing AS information. It also supports NSEL/ASA and NEL/NAT event logging.

Tags: Flow Analysis

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Network Security](https://cybersectools.com/categories/network-security) · [Network Detection and Response](https://cybersectools.com/categories/ndr)
- Deployment: On-Premises
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 887
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best SASE Solutions for Business](https://cybersectools.com/shortlists/best-sase-solutions).

## nfdump FAQ

### What is nfdump?

nfdump is a product in the Network Detection and Response category. It covers Flow Analysis.

### What is the pricing for nfdump?

nfdump is free. Download and setup instructions are at https://github.com/phaag/nfdump/.

### What are alternatives to nfdump?

Alternatives to nfdump listed on CybersecTools:

1. [ManageEngine NetFlow Analyzer](https://cybersectools.com/tools/manageengine-netflow-analyzer) - Flow-based network traffic monitoring and bandwidth analysis tool (Commercial)
2. [NIKSUN FlowAggregator™](https://cybersectools.com/tools/niksun-flowaggregatortm) - Flow-based network monitoring platform for performance and security visibility (Commercial)
3. [Genie Networks GenieATM FLB](https://cybersectools.com/tools/genie-networks-genieatm-flb) - Flow load balancer for distributing & filtering NetFlow records to collectors. (Commercial)
4. [Solana Networks TrafficWiz](https://cybersectools.com/tools/solana-networks-trafficwiz) - Deep learning-based encrypted traffic classification up to 25 Gbps w/o decryption. (Commercial)
5. [ipoque R&S PACE 2 (DPI Engine)](https://cybersectools.com/tools/ipoque-rands-pace-2-dpi-engine) - Embeddable DPI engine for real-time protocol/app classification up to L7. (Commercial)

Compare all nfdump alternatives at [https://cybersectools.com/alternatives/nfdump](https://cybersectools.com/alternatives/nfdump)

### What deployment and organization size does nfdump fit?

nfdump is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare nfdump with similar solutions

- [nfdump vs ManageEngine NetFlow Analyzer](https://cybersectools.com/compare/manageengine-netflow-analyzer-vs-nfdump)
- [nfdump vs NIKSUN FlowAggregator™](https://cybersectools.com/compare/nfdump-vs-niksun-flowaggregatortm)
- [nfdump vs Genie Networks GenieATM FLB](https://cybersectools.com/compare/genie-networks-genieatm-flb-vs-nfdump)

All alternatives to nfdump: [/alternatives/nfdump](https://cybersectools.com/alternatives/nfdump)

---

Source: https://cybersectools.com/tools/nfdump

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on nfdump: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md