SiLK

https://github.com/phaag/nfdump

nfdump is a toolset in order to collect and process netflow/ipfix and sflow data, sent from netflow/sflow compatible devices.

The toolset contains several collectors to collect flow data:

• nfcapd supports netflow v1, v5/v7, v9 and IPFIX
• sfcapd supports sflow.
• nfpcapd converts pcap data read from a host interface or from pcap files.

The collected flow data is stored into files and can be process afterwards. nfdump processes and lists the flows in many different output formats and can create a wide range of statistics.