| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: nfdump | Distribution: openSUSE Tumbleweed |
| Version: 1.7.10 | Vendor: openSUSE |
| Release: 1.1 | Build date: Mon Sep 7 18:22:09 2026 |
| Group: Productivity/Networking/Diagnostic | Build host: reproducible |
| Size: 950509 | Source RPM: nfdump-1.7.10-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://github.com/phaag/nfdump | |
| Summary: CLI tools to collect and process netflow data | |
The nfdump tools collect and process netflow data on the command line. They are part of the NFSEN project which is explained more detailed at http://www.terena.nl/tech/task-forces/tf-csirt/meeting12/nfsen-Haag.pdf
BSD-3-Clause
* Mon Sep 07 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.10
* fixes a build-flag regression that silently broke a core feature
for anyone building with plain gcc -O3. clang is not affected.
* Sun Sep 06 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.9
Security fixes
* Fixed several use-after-free and DoS issues in IPFIX options
template handling (remote-triggerable in nfcapd).
* Fixed integer overflows / NULL-deref in NetFlow v9 option
template processing.
* Fixed stack/heap out-of-bounds reads in legacy v1 file headers
and malformed NBAR/VRF records.
* Fixed multiple integer overflows and OOB reads in the sFlow
decoder (MPLS/VLAN, extended gateway, L4, 802.11 MAC).
* Hardened MaxMind and Tor lookup parsers.
Bug fixes
* Fixed crash and a race condition with multiple dynamic flow
sources.
* Fixed nfanon single-output-file and IPv6 anonymization bugs.
* Fixed icmp handling when data is absent.
* Fixed a memory leak in sgregex.
Improvements
* Maxmind and Tor-DB loading up to 40% faster.
* New %gra geo-enriched router/exporter address tag and geo info
added to output_raw.
* Added missing srcasn/dstasn/ext aggregation.
* Added IPFIX nsec time elements 156/157 (VPP 17.07 compatible).
* Thu Apr 30 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.8
* Improved build system using autotools.
* Fully revised pcap reader; old implementation removed.
* Improved overall code robustness and extensive cleanup of
legacy code.
* Correct handling of records containing both IPv4 and IPv6
extensions.
* Implemented dual‑stack listener support for nfcapd and sfcapd.
* Cleaned up sequence checks in NetFlow v5 and v9 modules.
* Major refactoring of the collector’s generic code; removed old
exporter flowsource logic.
* Added --enable-lto to enable link‑time optimization.
* Added --enable-native to generate locally optimized binaries.
* Exporter IP anonymization added to nfanon.
* User‑supplied worker thread count now also applies to filter
threads.
* Introduced a post‑processor thread in the collector to speed
up rotation cycles.
* nfanon now supports -W num to request a specific number of
worker threads.
* Removed MAXWORKERS; worker count is now limited only by
available CPU cores.
* Fixed memory leaks in SSL payload processing.
* Improved nfpcapd with an adaptive slab allocator and
replacement of the RB‑tree with an open hash.
* Replaced the pcap reader in nfpcapd with a faster mmap‑based
version.
* Replaced slow packet dump code with native system calls in
nfpcapd.
* Fixed IP fragment initialization in nfpcapd.
* Fixed race conditions and replaced all localtime() calls with
thread‑safe localtime_r().
* Sun Nov 09 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.7
* Implement yaf file reader.
* Improve nfpcapd on payload handling.
* Evaluate IPv6 fragmentation header and reassemble IPv6 packets.
* Update IPv4 fragmentation code.
* Replace dns packet decoder with more complete SPCDNS decoder.
* Improve payload filter.
* Add element statistics about tunnel protocols.
* Add TCP Flags aggregation option.
* Add new nfdump filter syntax cheatsheet.
* Improve HexDump output - cyber chef compatible.
* Honor the ipVersion flag, if exported.
* Lots of code cleanups.
* Fri Apr 18 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.6
* Improve speed through some code optimisation.
* Improve support for Palo Alto PA-5420.
* Add filter for min ttl and max ttl ttl equal filter for
min ttl == max ttl.
* Implements Tunnel extension & IPv6 encapsulation in sfcapd.
* Allow user selected output format with custom aggregation.
* Add ident as %idt token in output formats.
* Teach nfpcapd to read gzip compressed pcap files transparently.
* Improve exporter algorithm.
* Add Subdir -S to dynamic FlowSource -M.
* Extend timeWindow to msec format everywhere.
* Lot's of bug fixes and tiny changes.
* Wed Oct 23 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.5
* Improved parallel filtering to improve performance of nfdump.
* Parallel processing of reading, filtering and processing data.
* Add ndjson output format.
* Speedup output.
* Add ja4 processing.
* Officially integrate torlookup into nfdump.
* Add support for NOKIA enterprise.
* Lot of code cleanup.
* Bug fixes.
* Sun Mar 31 2024 Bernhard Wiedemann <bwiedemann@suse.com>
- Update to version 1.7.4
* make builds reproducible (boo#1047218)
* various bug fixes and stability fixes
* Lot of old code got cleaned up
* Wed Feb 07 2024 Dominique Leuenberger <dimstar@opensuse.org>
- Provide user/group symbol for the user created during pre.
* Sat Sep 02 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.3
* Add zstd compression speeds compression (multi threading)
* Add compression levels.
* Fix some nfprofile issues.
- Update to version 1.7.2
* Update nfcapd/sfcapd man pages for erspan data link.
* Implement erspan protocol in nfpcapd packet processing.
* Sync ipfix and netflow_v9 for option field processing.
* Handle buggy option data(!) from exporter.
* Fixes compile warnings for Linux(es) and *BSDs.
* Fix v9 option template processing.
* Fix option record processing for multiple records.
* Fix ipfix nbar processing.
* Update pcap reader with erspan device.
* Fix fmt argument parsing.
* Add IPv4 in IPv6 special cases in geolookup.
* Fix IP version check in geolookup.
* Disable signals in threads. Different OS handle signals
differently.
* Recongnize old sampler with missing algorithm tag.
* Fix memory leaks.
* Update pcap_reader and add CISCO application performance
monitor tags.
* Add ERSPAN decoding to pcap_reader.
* Check uid root for src spoofing option.
* Fix valgrind error for uninitalised memory.
* Update lz4 code.
* Update number of enabled tags in v9 and ipfix.
* Add collector option -X to limit stored data.
* Implement %sasn, %dasn organisation name printing tags.
* Improve geoDB handling. Needs rebuild of the geoDB.
* Wire sampling extension for individual sampling.
* Update ICMP type/code handling.
* Fix #415. ICMP decoding in netflow v9.
* Pimp pcap_reader
* Added source address support for nfreplay
* Fix dst tos bug in output_raw.
* Add geo info in JSON output when using GeoDB.
* Fix 408. Interchanged time stamps.
* Add icmp type/code elements 176, 177, 178, 179.
* Add unique version string.
* Add Linux nflog in nfpcapd.
* Replace old packet repeater code with more modern privsep code
* Replace old launcher startup code with more modern privsep code
* Wed Jan 11 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 1.7.1
* Fix #394. Event labeling
* Implement #393 consistent logging
* Add feature #391. Add country code aggregation
* Fix #392. Fix format options with IPv6
* Implement #390. Aggregation for GeoDB's enriched AS data
* Add OpenBSD pflog decoding in nfpcapd and nfdump
* Fix #389 receiving IPv4 on IPv6 socket in sfcapd
* Fix #385 bug when compiled on i386 arch - 32bit alignment
* Fix #384 bug when compile with --enable-nsel
* Implement #366 Linux NFLOG link layer protocol in nfpcapd
* Fix #381 pcap overwrite in nfpcapd fixed
* Implement #377. Rework sampling code in general. Switch to
packet interval/space notation. Map older sampling to new
notation.
* Fix #375 relative timestamps with sysUptime id 160
* Rework nbar code. Use new array records and fix nbar bug in
older versions.
* Fix #370. Help shows correct option -A
* Fix #369. Legacy -M for NfSen works again
* Improve nbar handling. Add private enterprise number decoding
/etc/nfdump.conf.dist /usr/bin/geolookup /usr/bin/nfanon /usr/bin/nfcapd /usr/bin/nfdump /usr/bin/nfexpire /usr/bin/nfprofile /usr/bin/nfreplay /usr/bin/nftrack /usr/bin/sfcapd /usr/bin/torlookup /usr/bin/updateGeoDB.sh /usr/bin/updateTorDB.sh /usr/share/doc/packages/nfdump /usr/share/doc/packages/nfdump/AUTHORS /usr/share/doc/packages/nfdump/ChangeLog /usr/share/doc/packages/nfdump/README.md /usr/share/licenses/nfdump /usr/share/licenses/nfdump/COPYING /usr/share/licenses/nfdump/LICENSE /usr/share/man/man1/geolookup.1.gz /usr/share/man/man1/nfanon.1.gz /usr/share/man/man1/nfcapd.1.gz /usr/share/man/man1/nfdump.1.gz /usr/share/man/man1/nfexpire.1.gz /usr/share/man/man1/nfprofile.1.gz /usr/share/man/man1/nfreplay.1.gz /usr/share/man/man1/sfcapd.1.gz /usr/share/man/man1/torlookup.1.gz /var/lib/nfcapd /var/lib/nfdump /var/lib/sfcapd
Generated by rpm2html 1.8.1
Fabrice Bellet, Wed Sep 9 22:40:46 2026