Cisco routers are able to generate NetFlow flows that can be captured and then analyzed in order to manage what is going on on your network. Unfortunately, I don't have a Cisco router in my toolbox so I'm looking for a opensource/free solution to generate the flows (act as a Cisco router) and to capture them.

I've already found this and this but it doesn't seems to generate flows, only ways to capture them.

Thank you


I think you are looking for softflowd:

Softflowd is flow-based network traffic analyser capable of Cisco NetFlow™ data export. Softflowd semi-statefully tracks traffic flows recorded by listening on a network interface or by reading a packet capture file. These flows may be reported via NetFlow™ to a collecting host or summarised within softflowd itself.

Softflowd can export using NetFlow version 1, 5 or 9 datagrams and it is fully IPv6 capable: it can track and report on IPv6 traffic and flow export datagrams can be sent to an IPv6 host. Any standard NetFlow collector should be able to process the reports from softflowd.

  • Exactly what I needed. Thank you. Softflowd comes with Softflowctl which can be used to see the flows. Feb 4 '12 at 19:30

nProbe is a software based flow solution supporting NetFlow v5, v9, and IPFIX. Using the IPFIX capabilities of nProbe you can export far greater information about the traffic over traditional NetFlow:

HTTP - URLs and network/server latency

DNS - all name resolution activies

SIP,RTP - decodes VoIP traffic and is feature rich with caller-id, codec, dscp values, packet loss, and jitter. Everything you want when troubleshooting or reviewing voice.

nProbe is not free, however it is low cost. The rich detail it kicks out makes it a no-brainer if you have no other flow capable devices on your network.

YAF is Yet Another Flowmeter - This is a free tool supporting v5, v9, and IPFIX. It does not have all of the features that nProbe contains, however this is also a good solution.

If you are not savvy with linux, nProbe offers a Windows version.


The second link you provided (switch.ch) lists a number of products that will create flows from network traffic. I've setup SiLK (which uses YAF) for doing exactly what you've described.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.