https://cybertoolchain.io/tools/nfdump New releases and features in nfdump, tracked by The Cyber Toolchain. en Sun, 06 Sep 2026 14:31:54 GMT https://github.com/phaag/nfdump/releases/tag/v1.7.9 https://github.com/phaag/nfdump/releases/tag/v1.7.9 Sun, 06 Sep 2026 14:31:54 GMT nfdump 1.7.9 adds %gra geo-enriched exporter tag, IPFIX nsec elements 156/157, and srcasn/dstasn/ext aggregation • Adds `%gra` geo-enriched router/exporter address tag for use in `fmt` output, plus geo info in `output_raw` • Adds IPFIX nanosecond-precision time elements 156/157 (compatible with VPP 17.07) • Adds missing `srcasn`, `dstasn`, and `ext` fields to flow aggregation • Multi-stage Docker builds now produce separate `nfcapd` (collector) and `nfdump` (client) targets, run as non-root by default Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.8 https://github.com/phaag/nfdump/releases/tag/v1.7.8 Tue, 28 Apr 2026 10:36:01 GMT nfdump v1.7.8 adds dual-stack listener support to nfcapd/sfcapd and worker/thread controls for nfanon. • Adds `--enable-lto` configure flag to enable link-time optimization • Adds `--enable-native` configure flag to generate locally optimized binaries • User-supplied worker thread count now also applies to filter threads • Introduced a post-processor thread in the collector to speed up rotation cycles • **nfanon** now supports `-W num` to request a specific number of worker threads Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.7 https://github.com/phaag/nfdump/releases/tag/v1.7.7 Mon, 10 Nov 2025 14:59:02 GMT nfdump v1.7.7 adds YAF file reader, TCP Flags aggregation, IPv6 reassembly, SPCDNS decoder, and HexDump output improvements • Implements `yaf` file reader • Add `TCP Flags` aggregation option • Evaluate IPv6 fragmentation header and reassemble IPv6 packets • Replace dns packet decoder with more complete SPCDNS decoder • Add new nfdump filter syntax cheatsheet • Improve HexDump output - cyber chef compatible Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.6 https://github.com/phaag/nfdump/releases/tag/v1.7.6 Fri, 18 Apr 2025 13:46:08 GMT nfdump 1.7.6 adds TTL filters, IPv6 tunnel support, gzip pcap reading, custom aggregation formats, and %idt token output. • Adds `min ttl`, `max ttl` and `ttl equal` filter options • Implements Tunnel extension and IPv6 encapsulation support in `sfcapd` • Allows user selected output format with custom aggregation • Adds `idt` token (`%idt`) for identifying flows in output formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.5 https://github.com/phaag/nfdump/releases/tag/v1.7.5 Wed, 23 Oct 2024 18:15:57 GMT nfdump v1.7.5 adds NDJSON output, JA4 processing, TorLookup integration, Nokia enterprise support and parallel filtering • Add `ndjson` output format for nfdump reports • Add JA4 (ja4) processing to network flow analysis • Add support for NOKIA enterprise in the netflow collector/parser • Improve performance with parallel filtering and parallel processing of reading, filtering and data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.4 https://github.com/phaag/nfdump/releases/tag/v1.7.4 Sat, 17 Feb 2024 14:28:13 GMT nfdump v1.7.4 adds -X extlist flag for sfcapd, cgNAT IPFIX decoding, and wildcard directory support. • Adds `-X <extlist>` option to `sfcapd` to specify custom extensions • Supports multiple directory wildcards `'@'` for the `-M` argument Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.3 https://github.com/phaag/nfdump/releases/tag/v1.7.3 Sat, 02 Sep 2023 11:30:57 GMT nfdump v1.7.3 adds zstd compression with threading and levels, new `-z` flag, maxworkers config, nfprofile syslog/flush/verification • `-z=<format>` unified compression argument replacing `-j`/`-y` (supports `zstd`, `lz4`) for nfdump output. • Config key `maxworkers` in `nfdump.conf` to limit worker thread count for nfcapd/nfreplay. • nfprofile now emits syslog by default, supports the flush() function, and performs file verification on save. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.2 https://github.com/phaag/nfdump/releases/tag/v1.7.2 Sun, 23 Apr 2023 12:46:55 GMT nfdump v1.7.2 adds ERSPAN support, JSON geo output, new nfcapd flags/tags • Adds `-X` collector option to limit stored data in `nfcapd` and `sfcapd` • Implements ERSPAN protocol support in `nfpcapd` for capturing encapsulated traffic • Adds OpenBSD pflog format capture in `nfpcapd` • Adds Linux nflog capture in `nfpcapd` • Adds Geo info to JSON output when using GeoDB with the `json` flag • Implements `%sasn` and `%dasn` printing tags for source/destination AS organization names in `nfcapd` • Adds source address support for `nfreplay` Breaking changes: • GeoDB must be rebuilt for correct handling of updated geo info. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v1.7.1 https://github.com/phaag/nfdump/releases/tag/v1.7.1 Sat, 24 Dec 2022 12:31:59 GMT nfdump v1.7.1 adds country code and GeoDB AS aggregation plus OpenBSD pflog decoding • Adds aggregation for GeoDB's enriched AS data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump https://github.com/phaag/nfdump/releases/tag/v.1.7.0 https://github.com/phaag/nfdump/releases/tag/v.1.7.0 Wed, 28 Sep 2022 13:10:36 GMT nfdump v1.7.0 adds multi-threading, NBAR support, Maxmind geo-location, and nfpcapd metric exports • Adds `nfpcapd` metric export feature: sends flow summary statistics to a UNIX socket every 60s for InfluxDB or Prometheus ingestion • Adds Maxmind geo-location capabilities to tag/geolocate IP addresses and AS numbers • Enables nfpcapd to automatically use TPACKET_V3 on Linux or direct BPF sockets on *BSD, adding options to collect MAC, VLAN, and first payload packet info Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nfdump