What is nfsen-ng?

nfsen-ng provides a web interface for analyzing NetFlow, sFlow, and IPFIX traffic data. It acts as a modern replacement for the NfSen frontend while using the nfdump toolkit and nfcapd collector underneath. The interface updates in real time through Server-Sent Events via the Datastar library. Seven main views exist: a traffic overview with graphs and key metrics, top talkers ranked by any nfdump statistic, individual flow records with raw output, conversation maps as Sankey diagrams or matrices, threshold-based alerts with history, system health monitoring, and configuration settings. Time-series metrics can be stored in RRD databases or VictoriaMetrics, while filters, alert history, and precomputed rankings use SQLite. The server runs on PHP 8.4 with the OpenSwoole extension (Linux only) via the php-via framework. Deployment options include Docker Compose (recommended) or bare-metal installation on Ubuntu or Debian. The application has no built-in authentication and depends on a reverse proxy or network placement for access control. An optional read-only MCP server enables AI-assisted traffic investigation. All configuration uses NFSEN_* environment variables. Minimum requirements are PHP 8.4 with the necessary extensions for OpenSwoole, inotify, brotli compression, RRD support, and SQLite via PDO, plus nfdump 1.7.10 or newer, and a 512 MB memory limit. The project is in beta (version 1.0.0-beta.6 as of October 2026) and maintained by Michael Bolli.

Should you self-host nfsen-ng?

nfsen-ng scores 47/100 on selfhost.directory (how scoring works) and ranks #31 of 48 in Network Monitoring. It has 285 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is Apache-2.0-licensed and written mostly in PHP.

Its closest alternative on selfhost.directory is mitmproxy (86/100, 46 446 stars). It scores higher overall, so compare the two before you pick. See nfsen-ng vs mitmproxy side by side.

Features

Conversations analysis
Cost estimation before queries
Flow inspection
GeoIP enrichmentOptional; requires MaxMind database or API key
Health Monitoring
MCP server for AI agentsOff by default; stdio or HTTP endpoint
NetFlow/sFlow/IPFIX visualization
Overview Dashboard
Real-time SSE updates
RRD storage backend
SQLite for filters and alerts
Threshold alerting
Top Talkers analysis

How to configure nfsen-ng

NFCAPD_TZTimezone nfcapd used when writing filenames
Timezone nfcapd used when writing filenames
values: IANA timezone (e.g., Europe/Berlin)
NFSEN_ALERT_EMAIL_FROMFrom-address for alert emails; enables email alert channel when set
From-address for alert emails; enables email alert channel when set
NFSEN_CAPTURE_INTERVALautoSeconds between nfcapd files (60, 120, 180, 240, 300, 360, 600, 720, 900, 1200, 1800, 3600, or auto)
Seconds between nfcapd files (60, 120, 180, 240, 300, 360, 600, 720, 900, 1200, 1800, 3600, or auto)
values: 60, 120, 180, 240, 300, 360, 600, 720, 900, 1200, 1800, 3600, auto
NFSEN_DEFAULT_THEMEautoInstance theme (auto, dark, light)
Instance theme (auto, dark, light)
values: auto, dark, light
NFSEN_GEOIP_DBPath to a MaxMind GeoLite2 or GeoIP2 City or Country .mmdb file
Path to a MaxMind GeoLite2 or GeoIP2 City or Country .mmdb file
NFSEN_IMPORT_YEARS3Years of history to scan on import
Years of history to scan on import
NFSEN_IPINFO_TOKENAPI key for the geolocation service
API key for the geolocation service
NFSEN_IPINFO_URLhttps://ipapi.co/{ip}/json/Geolocation endpoint template
Geolocation endpoint template
NFSEN_LOG_LEVELINFOLog level (DEBUG, INFO, NOTICE, WARNING, ERR, CRIT, ALERT, EMERG)
Log level (DEBUG, INFO, NOTICE, WARNING, ERR, CRIT, ALERT, EMERG)
values: DEBUG, INFO, NOTICE, WARNING, ERR, CRIT, ALERT, EMERG
NFSEN_MAX_STATS_WINDOW0Max window of Top Talkers, Conversations and filtered graphs in seconds (0 = unlimited)
Max window of Top Talkers, Conversations and filtered graphs in seconds (0 = unlimited)
NFSEN_MCP_HOSTSlocalhostHostnames a client may address the MCP server as (DNS rebinding protection)
Hostnames a client may address the MCP server as (DNS rebinding protection)
NFSEN_MCP_HTTPfalseServe the read-only MCP endpoint at /_mcp on the app's own port
Serve the read-only MCP endpoint at /_mcp on the app's own port
values: true, false
NFSEN_MEMORY_LIMIT512MPHP memory_limit of the server (e.g., 2G)
PHP memory_limit of the server (e.g., 2G)
NFSEN_NETBOX_TOKENRead-only NetBox API token
Read-only NetBox API token
NFSEN_NETBOX_URLBase URL of NetBox instance
Base URL of NetBox instance
NFSEN_NFDUMP_BINARY/usr/local/nfdump/bin/nfdumpPath to the nfdump binary
Path to the nfdump binary
NFSEN_NFDUMP_MAX_PROCESSESautoParallel nfdump processes (auto or number)
Parallel nfdump processes (auto or number)
values: auto, 0, or positive integer
NFSEN_NFDUMP_PROFILEliveDefault profile subfolder
Default profile subfolder
NFSEN_NFDUMP_PROFILES/var/nfdump/profiles-dataRoot path to the nfcapd data tree
Root path to the nfcapd data tree
NFSEN_NFDUMP_WORKERS2Filter threads per nfdump process (-W flag)
Filter threads per nfdump process (-W flag)
values: 0-16
NFSEN_PORTSComma-separated port numbers to track (e.g., 80,443,22)
Comma-separated port numbers to track (e.g., 80,443,22)
NFSEN_RRD_PATH/var/lib/nfsen-ng/rrdWhere RRD files are stored
Where RRD files are stored
NFSEN_SKIP_DAEMONfalseDisable the embedded import daemon and periodic alert evaluation
Disable the embedded import daemon and periodic alert evaluation
values: true, false
NFSEN_SKIP_INITIAL_IMPORTfalseSkip initial import on startup
Skip initial import on startup
values: true, false
NFSEN_SOURCESComma-separated NetFlow source names (e.g., gw1,router)
Comma-separated NetFlow source names (e.g., gw1,router)
NFSEN_TOPN_RETENTION_DAYS31Days of per-interval top-N data kept in SQLite for Overview
Days of per-interval top-N data kept in SQLite for Overview
NFSEN_VM_HOSTvictoriametricsVictoriaMetrics hostname
VictoriaMetrics hostname
NFSEN_VM_PORT8428VictoriaMetrics HTTP port
VictoriaMetrics HTTP port
SWOOLE_MAX_COROUTINE10000Max concurrent coroutines / SSE connections
Max concurrent coroutines / SSE connections
SWOOLE_MAX_REQUEST0Requests per worker before restart (0 = unlimited)
Requests per worker before restart (0 = unlimited)
SWOOLE_WORKER_NUM1Worker processes (leave at 1)
Worker processes (leave at 1)
TZUTCContainer/process timezone
Container/process timezone
values: IANA timezone