SecureAnyCloud
Deployment guide

nfdump

Overview

nfdump is the de-facto open source toolkit for collecting and analyzing NetFlow, IPFIX and sFlow traffic data. nfcapd, the always-on collector, listens for flow exports from your routers, switches and firewalls. It writes them to compact per-interval capture files, and the nfdump command-line tool queries that archive with a fast, tcpdump-like filter language.

This image builds nfdump 1.7.8 from the current upstream release rather than the Ubuntu 24.04 archive package, which is still on 1.7.3 (published 2024-04-04, over two years behind at the time this image was built). nfcapd.service runs the collector on UDP port 9995 from the moment the VM boots. It writes flows to a dedicated data directory with retention configured out of the box, so the appliance never silently fills its disk.

What you get:

  • nfdump 1.7.8 (BSD-3-Clause) built from a sha256-pinned upstream source tarball
  • nfcapd.service running the NetFlow v5/v9, IPFIX and sFlow collector on UDP 9995
  • The full toolkit: nfdump (query), nfreplay (resend captured flows), nfanon (anonymize), nfexpire (retention), nfpcapd (pcap to flow conversion)
  • A daily retention timer (nfdump-expire.timer) enforcing a 30 day / 5GB cap
  • nfdump-firstboot.service for a per-VM instance note (no secrets, because none exist for this product)
  • Ubuntu 24.04 LTS base, patched at build time, with unattended security upgrades enabled
  • 24/7 SecureAnyCloud support, 24h response SLA

Security by design

The only two surfaces this appliance exposes are SSH and the flow-collection port. There is no web console, no management API, no database, and no other listener anywhere in this image.

  • No source allowlist on the flow port, by design. The purpose of nfcapd is to accept NetFlow, IPFIX and sFlow from your own routers and switches, which arrive from addresses this appliance cannot know in advance. These protocols carry no authentication of their own, so a collector accepts from any configured exporter address. As a hardening step, scope your Azure network security group to your own exporter address ranges, as described below.
  • No login, no bootstrap credential. nfcapd is a headless daemon with no web console and no product account. There is nothing to sign in to and no default credential. You administer the VM over your own key-based SSH.
  • The collector never runs as root. nfcapd.service runs under a dedicated, unprivileged nfdump system account with no login shell and no home directory.
  • Retention is preconfigured. nfexpire caps the archive at 30 days or 5GB, whichever is reached first. Both limits are easy to tune, and a daily timer enforces them.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet your routers, switches or firewalls can reach. Standard_B2s (2 vCPU, 4 GB RAM) is ample for a small to medium flow volume. The collector is I/O and memory bound rather than CPU bound. If you capture from a large fleet of exporters, expand the OS disk or adjust your retention window.

1

Deploy the Virtual Machine

Option A: Azure Portal

Search the Marketplace for nfdump NetFlow Collector on Ubuntu 24.04, choose your VM size, and provide your SSH public key. Attach a network security group that allows:

  • TCP 22 (admin SSH) from your management network only.
  • UDP 9995 (the flow collector) from your router, switch and firewall address ranges. NetFlow, IPFIX and sFlow carry no authentication of their own, so scope this as tightly as your exporter topology allows. Unlike a management port, this port must accept traffic from wherever your exporters are.

Option B: Azure CLI

RG="nfdump-prod"; LOCATION="eastus"; VM_NAME="nfdump-01" IMAGE_URN="sac1647283583153:nfdump-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name nfdump-vnet --address-prefix 10.70.0.0/16 --subnet-name nfdump-subnet --subnet-prefix 10.70.1.0/24 az network nsg create -g "$RG" --name nfdump-nsg az network nsg rule create -g "$RG" --nsg-name nfdump-nsg --name allow-admin-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name nfdump-nsg --name allow-flow-exporters --priority 110 \
  --source-address-prefixes "<your-router-and-switch-cidrs>" --destination-port-ranges 9995 --access Allow --protocol Udp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nfdump-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name nfdump-vnet --subnet nfdump-subnet --nsg nfdump-nsg --public-ip-sku Standard
2

Connect via SSH

ssh azureuser@<vm-ip>

Find the public IP with az vm show -d -g nfdump-prod -n nfdump-01 --query publicIps -o tsv.

3

Confirm the collector is running

sudo systemctl start nfcapd.service 2>/dev/null || true sleep 2
sudo systemctl status nfcapd.service --no-pager | head -10 ss -ulnp | grep 9995 nfdump -V

nfcapd.service should report active (running), listening on *:9995 (UDP), running as the nfdump user, and nfdump -V should report version 1.7.8.

4

Prove the collector actually captures flows

A green service status and an open port do not prove that a flow collector works. What matters is whether an arriving flow is written to disk in a format nfdump can query. This image ships the self-test it was built and validated with, so you can run the same check on your own VM at any time:

sudo /usr/local/sbin/nfdump-flow-roundtrip.py

The script crafts a real NetFlow v5 UDP packet carrying a marker flow between two RFC 5737 documentation addresses, so it cannot collide with real traffic. It sends the packet to the collector on 127.0.0.1:9995 and forces nfcapd to finalize its in-progress capture file. It then reads that file back with nfdump -r and asserts that the marker flow's source address, destination address and port are present. A line starting OK confirms success.

5

Query captured flows

Point your routers, switches or firewalls at this VM's address on UDP 9995. Most vendors call this "NetFlow export" or "IPFIX export" configuration. See your device's documentation for the exact syntax. Once flows start arriving, query the archive:

nfdump -R /var/lib/nfdump/flows nfdump -R /var/lib/nfdump/flows 'dst port 443' nfdump -R /var/lib/nfdump/flows 'src net 10.0.0.0/8'

The nfdump filter language is tcpdump-like:host <ip>, net <cidr>, port <n>, proto tcp|udp|icmp, combined with and/or/not. See man nfdump for the complete filter grammar and output format options (-o csv, -o json, aggregation with -A, top-N with -s).

6

Read this VM's instance note

sudo cat /root/nfdump-instance.txt

This appliance has no login and no bootstrap credential, so this file holds no secrets. It is a quick reference for this VM's private address, the collector port, the data directory and the retention policy. It is written once at first boot and is not regenerated on later boots.

7

Retention

nfexpire -l /var/lib/nfdump/flows

This shows the current retention configuration and the archive's current size and age. As shipped, the archive is capped at 30 days or 5GB, whichever is reached first, and a daily systemd timer enforces the cap. To change it:

sudo nfexpire -u /var/lib/nfdump/flows -t 60d -s 20G
sudo systemctl start nfdump-expire.timer

Managing the service

sudo systemctl status nfcapd.service
sudo systemctl restart nfcapd.service
sudo journalctl -u nfcapd.service -n 50 --no-pager

nfcapd has no live-reload signal. To change its configuration (rotation interval, listen address), edit /etc/systemd/system/nfcapd.service and restart the service. A restart also forces an immediate rotation of the current capture file, which is useful if you need to query the most recent data before the next 5 minute window closes. The collector performs one final rotation cycle before it stops, so no in-flight data is lost.

Server Components

Component Version Purpose

nfdump 1.7.8 The full toolkit: nfdump, nfcapd, sfcapd, nfreplay, nfanon, nfexpire, nfpcapd

nfcapd.service systemd Runs the NetFlow/IPFIX/sFlow collector under the unprivileged nfdump account

nfdump-expire.timer systemd Daily retention enforcement via nfexpire

nfdump-firstboot.service systemd Per-VM instance note (no secrets, because none exist for this product)

Ubuntu 24.04 LTS Base operating system

Filesystem Layout

Path Purpose

/var/lib/nfdump/flows/ Captured flow archive (nfcapd.YYYYMMDDHHMM files) and the nfexpire bookkeeping file

/root/nfdump-instance.txt Root-only per-VM instance note (informational, because this product has no credentials)

/usr/share/doc/sac/NFDUMP-LICENSE.txt The BSD-3-Clause license text as shipped upstream

/etc/systemd/system/nfcapd.service The collector unit

/etc/systemd/system/nfdump-expire.timer The daily retention timer

Persistence, first boot and updates

On each VM's first boot, nfdump-firstboot.service resolves this machine's own private address and writes the instance note. It runs once and does not run again. nfcapd.service starts independently and does not wait for it, because the collector needs no per-VM secret or configuration before it can accept flows.

Ubuntu security updates are applied automatically by unattended upgrades. nfdump itself was built from source at image build time, so new upstream releases arrive through a refreshed SecureAnyCloud image rather than through apt.

Troubleshooting

nfcapd.service is not active. Check sudo journalctl -u nfcapd.service -n 50 --no-pager. The most common causes are another process already bound to the UDP port, or the data directory /var/lib/nfdump/flows having lost its nfdump:nfdump ownership.

No flows are arriving. Confirm that your exporter is configured to send to this VM's address on UDP 9995. Confirm that the Azure NSG allows the exporter's source address range on UDP 9995. Then run sudo /usr/local/sbin/nfdump-flow-roundtrip.py to prove that the collector itself works. If that passes, the issue is upstream of this VM, in the exporter configuration or the network path.

nfdump -R returns nothing. The most recent capture file is still open and does not appear until the next rotation (every 5 minutes by default) or a systemctl restart nfcapd. This is expected, because nfcapd exposes a file to nfdump only after it is finalized.

Security Recommendations

  • Scope the Azure NSG to your actual exporter address ranges on UDP 9995, not Any. The collector accepts from any source by design, because NetFlow, IPFIX and sFlow have no protocol-level authentication. Network-level scoping is therefore the control that matters here.
  • Restrict admin SSH to your management network, and keep it key-based. There is no other credential to fall back on or misconfigure.
  • Size your retention to your investigation window. 30 days is a reasonable default. Extend it with nfexpire -u if your compliance or incident-response requirements need longer.
  • Forward query results to your SIEM or ticketing system as part of an incident workflow. The nfdump -o csv and -o json output formats suit this.

Support

For assistance, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Response time: 24/7, with a 24 hour response SLA
  • Website: https://secureanycloud.com

Deploy on Azure

Launch nfdump 1.7.8 on Ubuntu 24.04 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure