nfdump

No entries match these filters. Clear filters

1. v1.7.9 Sep 6, 2026 · issue 067

   nfdump 1.7.9 adds %gra geo-enriched exporter tag, IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. nsec elements 156/157, and srcasn/dstasn/ext aggregation

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.9 https://github.com/phaag/nfdump.git
   # already have the repo? check out this version:
   $ git checkout v1.7.9

   └──▷ TRY IT
   Aggregate flows by source and destination ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. to produce per-AS traffic summaries
   copy

   $ nfdump -r /flow_base_dir/router1/nfcapd.202501011200 -A srcasn,dstasn

   • Adds %gra geo-enriched router/exporter address tag for use in fmt output, plus geo info in output_raw
   • Adds IPFIX nanosecond-precision time elements 156/157 (compatible with VPP 17.07)
   • Adds missing srcasn, dstasn, and ext fields to flow aggregation
   • Multi-stage Docker builds now produce separate nfcapd (collector) and nfdump (client) targets, run as non-root by default
   • Adds %gra geo-enriched router/exporter address tag for use in fmt output, plus geo info in output_raw

   3 more in Everything

2. advisory CVE-2026-102733 Jul 23, 2026 · issue 128
   • CVE-2026-102733: Integer overflow in NetFlow v9 option template offset accumulation leads to heap OOB read (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
3. advisory CVE-2026-102694 Jul 23, 2026 · issue 128
   • CVE-2026-102694: NULL pointer dereference in NetFlow v9 sub-template sequencer traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. advisory CVE-2026-102691 Jul 23, 2026 · issue 128
   • CVE-2026-102691: Integer overflow in PushArrayNextElement leads to array record header corruption in NBAR/ifvrf option data processing (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.7.8)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. advisory CVE-2026-94558 Jul 22, 2026 · issue 128
   • CVE-2026-94558: Legacy v1-layout file header ident field causes stack out-of-bounds read in nfdump (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-94557 Jul 22, 2026 · issue 128
   • CVE-2026-94557: Heap out-of-bounds read parsing the interface/VRFVRFA Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. name array record in nfdump (nfdump -r) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-94559 Jul 22, 2026 · issue 128
   • CVE-2026-94559: Malformed appendix block causes an excessive loop and log-flood denial of service in nfdump (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects Version 1.7.8 and earlier)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-94553 Jul 22, 2026 · issue 128
   • CVE-2026-94553: Unauthenticated IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. withdraw-all leaves dangling template pointers, causing remote use-after-free in nfcapd (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects Version 1.7.8 and earlier 1.7.x)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. v1.7.8 Apr 28, 2026 · release notes

   nfdump v1.7.8 adds dual-stack listener support to nfcapd/sfcapd and worker/thread controls for nfanon.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.8 https://github.com/phaag/nfdump.git
   # already have the repo? check out this version:
   $ git checkout v1.7.8

   └──▷ TRY IT
   Enable link-time optimization during compilation for potential performance gains.
   copy

   $ ./configure --enable-lto

   Run nfanon with exactly 4 worker threads instead of the default auto-detection.
   copy

   $ nfanon -W 4 input.pcap

   • Adds --enable-lto configure flag to enable link-time optimization
   • Adds --enable-native configure flag to generate locally optimized binaries
   • User-supplied worker thread count now also applies to filter threads
   • Introduced a post-processor thread in the collector to speed up rotation cycles
   • nfanon now supports -W num to request a specific number of worker threads

   5 details in Everything

10. v1.7.7 Nov 10, 2025 · release notes

    nfdump v1.7.7 adds YAF file reader, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Flags aggregation, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. reassembly, SPCDNS decoder, and HexDump output improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.7 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.7

    • Implements yaf file reader
    • Add TCP Flags aggregation option
    • Evaluate IPv6 fragmentation header and reassemble IPv6 packets
    • Replace dns packet decoder with more complete SPCDNS decoder
    • Add new nfdump filter syntax cheatsheet

    +1 more show less

    • Improve HexDump output - cyber chef compatible

    6 details in Everything

11. v1.7.6 Apr 18, 2025 · release notes

    nfdump 1.7.6 adds TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. filters, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. tunnel support, gzip pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. reading, custom aggregation formats, and %idt token output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.6 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.6

    • Adds min ttl, max ttl and ttl equal filter options
    • Implements Tunnel extension and IPv6 encapsulation support in sfcapd
    • Allows user selected output format with custom aggregation
    • Adds idt token (%idt) for identifying flows in output formats

    4 details in Everything

12. v1.7.5 Oct 23, 2024 · release notes

    nfdump v1.7.5 adds NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. output, JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. processing, TorLookup integration, Nokia enterprise support and parallel filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.5 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.5

    • Add ndjson output format for nfdump reports
    • Add JA4 (ja4) processing to network flow analysis
    • Add support for NOKIA enterprise in the netflow collector/parser
    • Improve performance with parallel filtering and parallel processing of reading, filtering and data

    4 details in Everything

13. v1.7.4 Feb 17, 2024 · release notes

    nfdump v1.7.4 adds -X extlist flag for sfcapd, cgNAT IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. decoding, and wildcard directory support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.4 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.4

    └──▷ USE IT
    Capture sFlow records with specific custom extension fields defined in a list.
    shell copy

    sfcapd -X "flow_id,custom_metric" -i eth0

    • Adds -X <extlist> option to sfcapd to specify custom extensions
    • Supports multiple directory wildcards '@' for the -M argument

    2 details in Everything

14. v1.7.3 Sep 2, 2023 · release notes

    nfdump v1.7.3 adds zstd compression with threading and levels, new -z flag, maxworkers config, nfprofile syslog/flush/verification

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.3 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.3

    • -z=<format> unified compression argument replacing -j/-y (supports zstd, lz4) for nfdump output.
    • Config key maxworkers in nfdump.conf to limit worker thread count for nfcapd/nfreplay.
    • nfprofile now emits syslog by default, supports the flush() function, and performs file verification on save.

    3 details in Everything

15. v1.7.2 Apr 23, 2023 · release notes

    nfdump v1.7.2 adds ERSPANERSPANA Cisco-originated GRE-based tunneling protocol that encapsulates mirrored network traffic and ships it across Layer 3 to a remote capture point, letting cyber tools analyze traffic from distant segments without local tap hardware. support, JSON geo output, new nfcapd flags/tags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.2 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.2

    • Adds -X collector option to limit stored data in nfcapd and sfcapd
    • Implements ERSPAN protocol support in nfpcapd for capturing encapsulated traffic
    • Adds OpenBSD pflog format capture in nfpcapd
    • Adds Linux nflog capture in nfpcapd
    • Adds Geo info to JSON output when using GeoDB with the json flag

    +2 more show less

    • Implements %sasn and %dasn printing tags for source/destination AS organization names in nfcapd
    • Adds source address support for nfreplay

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GeoDB must be rebuilt for correct handling of updated geo info.
16. v1.7.1 Dec 24, 2022 · release notes

    nfdump v1.7.1 adds country code and GeoDB AS aggregation plus OpenBSD pflog decoding

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

17. v.1.7.0 Sep 28, 2022 · release notes

    nfdump v1.7.0 adds multi-threading, NBAR support, Maxmind geo-location, and nfpcapd metric exports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.7.0 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v.1.7.0

    • Adds nfpcapd metric export feature: sends flow summary statistics to a UNIX socket every 60s for InfluxDB or Prometheus ingestion
    • Adds Maxmind geo-location capabilities to tag/geolocate IP addresses and AS numbers
    • Enables nfpcapd to automatically use TPACKET_V3 on Linux or direct BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. sockets on *BSD, adding options to collect MAC, VLAN, and first payload packet info

    3 details in Everything

18. v1.6.23 May 6, 2021 · release notes

    nfdump v1.6.23 adds MPLS unwrap, ESP protocol support, new biFlow direction element 239, and other data collection improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.23 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.23

    • Add support for MPLS unwrapping in nfpcapd to skip MPLS labels.
    • Add support for the ESP protocol in nfpcapd processed protocols list.
    • Add reverse element enterprise ID 29305 for counter values.
    • Add biFlow direction element 239 and flow end reason element 136 to flow records.
    • Implement element 160 (SystemInitTime) in option template and add it to Huawei flow records.

    +2 more show less

    • Add packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. buffer size configuration to nfpcapd.
    • Set -Tall as the default for nfcapd to collect extensions.

    7 details in Everything

19. v1.6.22 Nov 21, 2020 · release notes

    nfdump v1.6.22 adds >= and <= comparators, nfcapd nfversion field, ICMPv6 element support, and new nip filter syntax

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.22 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.22

    └──▷ TRY IT
    Filter flows with source ports greater than or equal to 80 and less than or equal to 443 using the new comparators.
    copy

    $ nfdump -r flow.nf 'srcport >= 80 and srcport <= 443'

    Match traffic involving a specific list of IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. IP addresses using the new nip syntax.
    copy

    $ nfdump -r flow.nf 'nip in [ 2001:db8::1, 2001:db8::2 ]'

    • Adds >= and <= comparators for filter expressions in nfdump commands
    • Adds nfversion field output to nfcapd records
    • Adds element 139 support for ICMP type/code in IPv6 flows
    • Adds nip in [ <iplist> ] filter syntax for matching IP address lists

    4 details in Everything

20. v1.6.21 Aug 8, 2020 · release notes

    nfdump v1.6.21 adds dir filter token and rfc 7011 sender UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.21 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.21

    • Add dir filter syntax equivalent to flowdir for filtering flows by direction

    1 detail in Everything

21. v1.6.18 Aug 14, 2019 · release notes

    nfdump v1.6.18 adds nfpcapd to generate nfdump records directly from interfaces/pcapspcapsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.18 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.18

    └──▷ TRY IT
    Generate nfdump netflow records directly from a network interface without external conversion
    copy

    $ nfpcapd -i eth0 -o /path/to/output/dir

    └──▷ BREAKING ON UPGRADE

    • !The COMPAT15 mode has been removed; ensure all legacy 1.5.x files are converted before upgrading
22. v1.6.17 May 6, 2018 · release notes

    nfdump v1.6.17 adds JSON output, flow labeling with xlate aggregation, and IPFIXIPFIXAn IETF standard protocol for exporting network flow records from routers and probes to a collector, giving cyber tools a vendor-neutral stream of structured traffic metadata without full packet capture. delta timestamps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.17 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.17

    • Adds -o json option to nfdump for per-record JSON output
    • Adds %lbl print option to display flow labels in standard output
    • Adds support for labeling filter terms using (%filter) %labelname syntax
    • Adds IPFIX delta timestamp elements 158/159 processing

    4 details in Everything

23. v1.6.16 Nov 5, 2017 · release notes

    nfdump 1.6.16 adds CISCO IOS 8-byte timestamp support and bzip compress switch

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.16 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.16

    • Adds bzip compression switch to nfpcapd usage

    1 detail in Everything

24. v1.6.14 Jan 10, 2016 · release notes

    nfdump v1.6.14 adds libnfdump for dynamic linking, BZ2 compression, and new nfcapd samplers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.14 https://github.com/phaag/nfdump.git
    # already have the repo? check out this version:
    $ git checkout v1.6.14

    └──▷ TRY IT
    Export flow data using the new BZ2-compressed JSON format for efficient storage and transport.
    copy

    $ nfdump -R /data -o json:json_bz2

    • libnfdump created as a library for dynamic linking, enabling nfdump to be used by other applications rather than just as a standalone CLI tool.
    • New sampler support in nfcapd: standard sampler ID for 4-byte values and random sampler with tag 50, allowing capture of specific flow sampling configurations.
    • nfdump now supports BZ2 compression alongside existing LZ0 when using the -B flag (e.g., nfdump -R /data -o json:json_bz2).

    3 details in Everything