install

Additional install commands

macOS

Homebrewverified · 100%

brew install nfdump

provider-native install command

overview

Package summary

Tools to collect and process netflow data on the command-line

Project links

Homepage

Commands and aliases

geolookup
nfanon
nfcapd
nfdump
nfexpire
nfreplay
sfcapd
torlookup
updateGeoDB.sh
updateTorDB.sh

history

Project history and usage

nfdump is a long-lived command-line toolkit for collecting, storing, replaying, filtering, aggregating, and analyzing NetFlow, IPFIX, and sFlow data. The core workflow pairs collector daemons such as `nfcapd` and `sfcapd` with `nfdump` queries over rotated binary flow files.

Project history

The legacy SourceForge page says the project moved to GitHub and describes the original design: collect flow data to disk first, organize it in timestamped files, then analyze historical or continuous traffic with a fast tcpdump-like filter language. FreshPorts records the FreeBSD port being added on 2004-11-07 with version 1.1 and NetFlow v5/v7 support; later documentation and packaging show support expanded to v9, IPFIX, and sFlow.

The GitHub README describes the 1.7.x series codename `unicorn`, compatibility with files created by nfdump 1.6.18 or newer, and conversion paths for older legacy flow files.

Adoption history

nfdump is an infrastructure package rather than a trendy CLI. It appears across Homebrew, Debian, Ubuntu, Fedora, Alpine, Nix, MacPorts, and FreeBSD ports, and is tied historically to NfSen. The GitHub repository showed 1,405 commits when researched. Homebrew's API generated on 2026-07-01 reported 233 installs-on-request in the preceding 365 days.

How it is used

Practical users run `nfcapd` on UDP ports fed by routers, firewalls, or switches, rotate files every few minutes, and query them later with expressions such as `nfdump -r flowfile 'src ip 192.0.2.1 and dst port 443'`. The Debian nfcapd manpage says it accepts NetFlow v1, v5/v7, v9, and IPFIX transparently and works with exporters including Cisco Flexible NetFlow, ASA firewalls, NAT event logging, Juniper, VMware, Palo Alto, and yaf.

Why package nerds care

nfdump matters because it keeps the packet-capture mental model for flow records: small composable commands, tcpdump-like filters, files you can retain or expire, and text/CSV/JSON/custom output for shell pipelines and monitoring integrations.

Timeline

2004-11-07: FreshPorts records the FreeBSD nfdump port being added.
2014-12-01: legacy SourceForge page listed 1.6.13 as the stable version and pointed users to GitHub.
2026-07-01: Homebrew formula API generated data for nfdump 1.7.8.

Related projects

NfSen
NetFlow
IPFIX
sFlow
nfcapd
sfcapd
nfexpire
nfreplay

Sources

security posture

Risk level: yellow

generalized runtime or code generation signal.

Risk classifier

yellow risk · medium confidence · runtime

Why

generalized runtime or code generation signal

Signals

text:repl

Install behavior

No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`geolookup`	executable	indexed executable	Discovered from the local executable index.
`nfanon`	executable	indexed executable	Discovered from the local executable index.
`nfcapd`	executable	indexed executable	Discovered from the local executable index.
`nfdump`	executable	indexed executable	Discovered from the local executable index.
`nfexpire`	executable	indexed executable	Discovered from the local executable index.
`nfreplay`	executable	indexed executable	Discovered from the local executable index.
`sfcapd`	executable	indexed executable	Discovered from the local executable index.
`torlookup`	executable	indexed executable	Discovered from the local executable index.
`updateGeoDB.sh`	executable	indexed executable	Discovered from the local executable index.
`updateTorDB.sh`	executable	indexed executable	Discovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03

manager version1.7.8

manager updated

local dataunknown

upstreamnot available

latest detectednot detected

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:nfdump
Version	1.7.8
Package manager	Homebrew
Homepage	https://github.com/phaag/nfdump
Repository	https://github.com/phaag/nfdump
Bottle	not recorded
Service	none declared

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/nfdump.yml

Used sources

Geiger risk classifier
Nucleus package database
curated package history
pkgdb category and tag curation

Install nfdump with Homebrew