How-To: A NetFlow Dashboard on a Raspberry Pi With nfdump and nfsen-ng

Ever wonder what’s actually talking on your network? NetFlow tells you who talked to whom, how much and when. A Raspberry Pi running nfdump and nfsen-ng makes a nice little free dashboard.

How it fits together

• Exporter: your router or firewall sends flow records. If it can’t, softflowd can generate them from a mirrored port.
• Collector: nfcapd (part of nfdump) receives flows and writes them to disk in time slices.
• Dashboard: nfsen-ng reads those files and draws graphs you can filter in a browser.

Steps

1. Use a Pi 4 or 5 with an SSD if you can. Flow data writes a lot, and SD cards wear out.
2. Install nfdump and start nfcapd listening on a UDP port, writing to a data folder.
3. Point your router’s NetFlow/IPFIX export at the Pi on that port.
4. Install nfsen-ng (PHP plus a web server) and set its config to your data folder and source name.
5. Give it some time, then open the dashboard and start filtering by host, port or protocol.

Tip: set an expiry on old flow files so the disk doesn’t fill up, and keep the dashboard on your LAN only.

Happy Hacking!

References & Further Reading

• nfdump on GitHub
• nfsen-ng on GitHub
• softflowd on GitHub