{"id":36455852,"url":"https://github.com/phaag/go-nfdump","last_synced_at":"2026-01-11T23:03:23.169Z","repository":{"id":65711909,"uuid":"594801046","full_name":"phaag/go-nfdump","owner":"phaag","description":"go-nfdump: A Go module to read and process nfdump files","archived":false,"fork":false,"pushed_at":"2024-07-12T07:46:55.000Z","size":97,"stargazers_count":7,"open_issues_count":2,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-07-12T09:08:22.925Z","etag":null,"topics":["go","golang","netflow","nfdump"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/phaag.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-29T17:24:44.000Z","updated_at":"2024-07-12T07:46:58.000Z","dependencies_parsed_at":"2024-06-02T19:07:49.635Z","dependency_job_id":"782e157b-ba78-43c1-a78a-56823cf6a1ea","html_url":"https://github.com/phaag/go-nfdump","commit_stats":{"total_commits":33,"total_committers":1,"mean_commits":33.0,"dds":0.0,"last_synced_commit":"579af84e24ae382059ef4ffffcd028a9491c0ca2"},"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/phaag/go-nfdump","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phaag%2Fgo-nfdump","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phaag%2Fgo-nfdump/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phaag%2Fgo-nfdump/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phaag%2Fgo-nfdump/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/phaag","download_url":"https://codeload.github.com/phaag/go-nfdump/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phaag%2Fgo-nfdump/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28326167,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-11T22:11:01.104Z","status":"ssl_error","status_checked_at":"2026-01-11T22:10:58.990Z","response_time":60,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","netflow","nfdump"],"created_at":"2026-01-11T23:03:22.574Z","updated_at":"2026-01-11T23:03:23.164Z","avatar_url":"https://github.com/phaag.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# go-nfdump\n\n[![Go Reference](https://pkg.go.dev/badge/github.com/phaag/go-nfdump.svg)](https://pkg.go.dev/github.com/phaag/go-nfdump)\n[![buildtest](https://github.com/phaag/go-nfdump/actions/workflows/go.yml/badge.svg)](https://github.com/phaag/go-nfdump/actions/workflows/go.yml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/phaag/go-nfdump)](https://goreportcard.com/report/github.com/phaag/go-nfdump)\n\nThis Go module allows to read and process files created by [nfdump](https://github.com/phaag/nfdump), the netflow/ipfix/sflow collector and processing tools.\n\nThis module is experimental and does not yet decode all available nfdump record extensions. It reads and processes only nfdump v2 files, which are created by nfdump-1.7.x. Files created with nfdump-1.6.x are recogized but skipped for decoding.\n\nExpample to read and process a flow file:\n\n\n\n```go\n\npackage main\n\nimport (\n\t\"flag\"\n\t\"fmt\"\n\t\"os\"\n\n\tnfdump \"github.com/phaag/go-nfdump\"\n)\n\nvar (\n\tfileName = flag.String(\"r\", \"\", \"nfdump file to read\")\n)\n\nfunc main() {\n\n\tflag.CommandLine.Usage = func() {\n\t\tfmt.Fprintf(os.Stderr, \"Usage of %s [flags]\\n\", os.Args[0])\n\t\tflag.PrintDefaults()\n\t}\n\n\tflag.Parse()\n\n\tif len(*fileName) == 0 {\n\t\tfmt.Printf(\"Filename required\\n\")\n\t\tflag.PrintDefaults()\n\t\tos.Exit(255)\n\t}\n\n\tnffile := nfdump.New()\n\n\tif err := nffile.Open(*fileName); err != nil {\n\t\tfmt.Printf(\"Failed to open nf file: %v\\n\", err)\n\t\tos.Exit(255)\n\t}\n\n\t// print nffile stats\n\tfmt.Printf(\"nffile:\\n%v\", nffile)\n\n\t// Dump flow records\n\trecordChannel, _ := nffile.AllRecords()\n\tcnt := 0\n\tfor record := range recordChannel {\n\t\tcnt++\n\n\t\t// check IP addresses in record for IPv4, or IPv6\n\t\tif record.IsIPv4() {\n\t\t\tfmt.Printf(\"Record %d is IPv4\\n\", cnt)\n\t\t} else if record.IsIPv6() {\n\t\t\tfmt.Printf(\"Record %d is IPv6\\n\", cnt)\n\t\t} else {\n\t\t\tfmt.Printf(\"Record %d has no IPs\\n\", cnt)\n\t\t}\n\n\t\t// sampling\n \t\tpacketInterval, spaceInterval := record.SamplerInfo(nffile)\n\t\tfmt.Printf(\"Record sampler info: packet interval: %d, space interval: %d\\n\",\n               packetInterval, spaceInterval)\n    \n\t\t// print the entire record using %v\n\t\tfmt.Printf(\"%v\\n\", record)\n\n\t\t// get generic extension and print ports\n\t\t// see nfxV3.go for all fields in genericFlow\n\t\tif genericFlow := record.GenericFlow(); genericFlow != nil {\n\t\t\tfmt.Printf(\"SrcPort: %d\\n\", genericFlow.SrcPort)\n\t\t\tfmt.Printf(\"DstPort: %d\\n\", genericFlow.DstPort)\n\t\t}\n\n\t\t// get src, dst ip address extension of record\n\t\t// can contain IPv4 or IPv6\n\t\tipAddr := record.IP()\n\t\tif ipAddr != nil {\n\t\t\t// when printing as %v, Golang takes care about proper formating\n\t\t\t// as IPv4 or IPv6\n\t\t\t// see Golang standard library net.IP for more details to process IPs\n\t\t\tfmt.Printf(\"SrcIP: %v\\n\", ipAddr.SrcIP)\n\t\t\tfmt.Printf(\"DstIP: %v\\n\", ipAddr.DstIP)\n\t\t}\n    \n    // get NAT xlate IP adresses\n    if natXlateIP = flowRecord.NatXlateIP(); natXlateIP != nil {\n      fmt.Sprintf(\"  SrcXlateIP  : %v\\n\", natXlateIP.SrcXIP)\n      fmt.Sprintf(\"  DstXlateIP  : %v\\n\", natXlateIP.DstXIP)\n    }\n    \n    // get NAT xlate ports\n    if natXlatePort := flowRecord.NatXlatePort(); natXlatePort != nil {\n      fmt.Printf(\"  Src X-Port  : %d\\n\", natXlatePort.XlateSrcPort)\n      fmt.Printf(\"  Dst X-Port  : %d\\n\", natXlatePort.XlateDstPort)\n    }\n  \n    // get nat port block and print\n    if natPortBlock := flowRecord.NatPortBlock(); natPortBlock != nil {\n      fmt.Printf(\"  NAT pstart  : %d\\n\", natPortBlock.BlockStart)\n\t\t\tfmt.Printf(\"  NAT pend    : %d\\n\", natPortBlock.BlockEnd)\n\t\t\tfmt.Printf(\"  NAT pstep   : %d\\n\", natPortBlock.BlockStep)\n\t\t\tfmt.Printf(\"  NAT psize   : %d\\n\", natPortBlock.BlockSize)\n\t\t}\n \n    // get IP info extension\n    if ipInfo := flowRecord.IpInfo(); ipInfo != nil {\n      fmt.Pprintf(\"  IP ttl      : %d\\n\", ipInfo.Ttl)\n\t\t  fmt.Pprintf(\"  IP fragment : %s%s\\n\", ipInfo.FragmentFlags)\n    }\n    \n\t\t/*\n\t\t\t// other extension\n\t\t\t// see nfxV3.go for all fields in the respectiv records\n\t\t\t// always check for nil return value as not every extension\n\t\t\t// is available\n\t\t\tflowMisc := record.FlowMisc()\n\t\t\tcntFlow := record.CntFlow()\n\t\t\tvLan := record.VLan()\n\t\t\tasRouting := record.AsRouting()\n\t\t\tbgpNextHop := record.BgpNextHop()\n\t\t\tipNextHop := record.IpNextHop()\n\t\t\t\n\t\t\t// please note, sampling contains only references to exporter list\n\t\t\t// use record.SamplerInfo(nffile) to retrieve true sampling values\n\t\t\tsampling := record.Sampling()\n\t\t*/\n\t}\n  \n\t// retrieve exporter list *after* all records are processed\n\texporterList := nffile.GetExporterList()\n\tfmt.Printf(\"Exporter list:\\n\")\n\tfor id, exporter := range exporterList {\n\t\tif exporter.IP != nil \u0026\u0026 id == int(exporter.SysId) { // valid exporter\n\t\t\tfmt.Printf(\"  SysID: %d, ID: %d, IP: %v, version: %d\", \n                 exporter.SysId, exporter.Id, exporter.IP, exporter.Version)\n\t\t\tfmt.Printf(\" Sequence failures: %d, packets: %d, flows: %d\\n\",\n                 exporter.SequenceFailures, exporter.Packets, exporter.Flows)\n\t\t}\n\t}\n}\n```\n\nThe `defs.go` file includes nfdump's `nfxV3.h` header file to convert individual record extensions into appropriate Golang records. So far the generic, misc, flowCount, vlan and asRouting extensions as well as IPv4/IPv6 addresses are available through the interface. See the nfxV3.go file for its definitions.\n\nIf you modify the `defs.go` file, generate `nfxV3.go` use the go command\n\n`go generate ./...`\n\nAll available extensions are visible in `nfxV3.go`. \n\nPlease note, that the interface may be subject to change, as this module is work in progress.\n\nMore element data blocks will follow, including the famous nfdump filter engine.\nPlease submit your pull requests and/or bug reports via [GitHub](https://github.com/phaag/go-nfdump/issues).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphaag%2Fgo-nfdump","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fphaag%2Fgo-nfdump","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphaag%2Fgo-nfdump/lists"}