<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing NetFlow Data — API & Tool Reference

> Quick reference for tools, commands, and APIs used in analyzing-netflow-data.

## Tools


### `nfdump`

NetFlow data analysis tool

**Usage:**
```bash
nfdump -r <file> [filter] -s <stat> -n <count>
```

**Key Flags:**
  - `-r: read single file`
  - `-R: read directory`
  - `-s: statistics (srcip/bytes, dstport/flows)`
  - `-n: top N`
  - `-o: output format (csv, extended, fmt)`

---

### `nfcapd`

NetFlow capture daemon

**Usage:**
```bash
nfcapd -w -D -l <dir> -p <port>
```

**Key Flags:**
  - `-w: sync file rotation`
  - `-D: daemon mode`
  - `-l: output directory`
  - `-p: listen port`
  - `-T: extension map`

---

### `softflowd`

Software NetFlow exporter

**Usage:**
```bash
softflowd -i <iface> -n <collector>:<port>
```

**Key Flags:**
  - `-i: capture interface`
  - `-n: collector address`
  - `-v: NetFlow version (5/9/10)`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
