nfsen-ng

nfsen-ng

Docker app from mbolli's Repository

Overview

nfsen-ng is a modern, in-place replacement for the ageing NfSen web frontend. It sits on top of the nfdump tools and visualises NetFlow / sFlow / IPFIX traffic with real-time SSE push, a responsive light/dark UI, Sankey traffic-flow diagrams, and RRD or VictoriaMetrics storage. This is the WEB UI. It only displays flow data that a collector has already written to its data directory. Install the companion "nfsen-ng-nfcapd" collector template (or run the bundled Compose stack) and mount BOTH containers on the SAME appdata path so the UI can read what the collector writes. A device on your network (pfSense/OPNsense/MikroTik/…) must export flows to the collector. The app does not terminate TLS by design; front it with SWAG, Nginx Proxy Manager, or Traefik.

nfsen-ng

GitHub release GitHub license GitHub issues GitHub last commit GitHub stars PHP 8.4 OpenSwoole Docker Donate a beer

nfsen-ng is a modern, in-place replacement for the ageing NfSen web frontend. It sits on top of the existing nfdump tools and adds real-time SSE push, a responsive UI, and support for RRD or VictoriaMetrics as the storage backend.

Requires Linux. The backend runs on the OpenSwoole PHP extension, which has no maintained FreeBSD/other-BSD port — see openswoole/ext-openswoole#233. Docker images are Linux-only.

nfsen-ng dashboard overview, light and dark

nfsen-ng Sankey diagram visualizing src IP -> dst port -> dst IP traffic flow, light and dark Sankey traffic-flow diagram with the optional destination-port column, available since v1.0.0-beta.1.

Quick start

No clone needed — just grab the compose file and go:

curl -O https://raw.githubusercontent.com/mbolli/nfsen-ng/master/deploy/docker-compose.yml

# Edit NFSEN_SOURCES, NFSEN_NFDUMP_PROFILES, and other env vars in docker-compose.yml, then:

# Production with bundled Caddy (auto-HTTPS, ports 80/443)
docker compose --profile proxy up -d

# Production behind your own reverse proxy (app on port 9000 only)
docker compose up -d

The app image is published on GHCR: ghcr.io/mbolli/nfsen-ng. The bundled-Caddy profile uses the stock caddy:latest image — no custom build needed, since php-via serves and Brotli-compresses static assets itself. :latest tracks the newest release, betas included while pre-1.0; :edge always tracks the newest master build; or pin an explicit version tag from Releases for a fixed image.

Development (source mounted, auto-reload on file change):

git clone https://github.com/mbolli/nfsen-ng
cd nfsen-ng
docker compose -f deploy/docker-compose.dev.yml up -d

Set NFSEN_SOURCES, NFSEN_NFDUMP_PROFILES, and other options as environment variables in your compose file. See Installation and Configuration in the book for the full guide.

Documentation

The full user guide and developer reference now live in the nfsen-ng book — installation, configuration, every tab's feature docs, and the architecture/signals/SSE internals for contributors.

Migrating from the old v0.x NfSen-style release? See the upgrade guide in the book.

Install nfsen-ng on Unraid in a few clicks.

Find nfsen-ng in Community Apps on your Unraid server, review the template, and click Install. Unraid handles the Docker app or plugin setup from the published template.

Open the Apps tab on your Unraid server Search Community Apps for nfsen-ng Review the template variables and paths Click Install

Requirements

A NetFlow/sFlow/IPFIX collector must write into the same data directory this container reads. Use the companion nfsen-ng-nfcapd template and point both at the same appdata path (default /mnt/user/appdata/nfsen-ng). Your router/switch must export flows to the collector's UDP port.

Related apps

Details

Repository
ghcr.io/mbolli/nfsen-ng:latest
Last Updated2026-07-08
First Seen2026-07-08

Runtime arguments

Web UI
http://[IP]:[PORT:9000]/
Network
bridge
Shell
bash
Privileged
false
Extra Params
--restart unless-stopped

Template configuration

Web UIPorttcp

nfsen-ng web interface (OpenSwoole HTTP). Front with a reverse proxy for TLS.

Target
9000
Default
9000
Value
9000
Data (profiles)Pathrw

nfdump profiles/flow-file directory. MUST be the same path the collector writes to.

Target
/data/nfsen-ng
Default
/mnt/user/appdata/nfsen-ng
Value
/mnt/user/appdata/nfsen-ng
TimezoneVariable

Container timezone.

Target
TZ
Default
UTC
Value
UTC
SourcesVariable

Comma-separated source names. Each must exist as live/name under the data directory — i.e. match the collector's output sub-directory.

Target
NFSEN_SOURCES
Default
flows
Value
flows
Tracked portsVariable

Comma-separated port numbers tracked per source in RRD.

Target
NFSEN_PORTS
Default
80,443,22,53
Value
80,443,22,53
nfdump profiles pathVariable

Container-side profiles path. Must equal the 'Data (profiles)' mount target above.

Target
NFSEN_NFDUMP_PROFILES
Default
/data/nfsen-ng
Value
/data/nfsen-ng
nfdump binaryVariable

Path to the nfdump binary inside the container.

Target
NFSEN_NFDUMP_BINARY
Default
/usr/local/nfdump/bin/nfdump
Value
/usr/local/nfdump/bin/nfdump
Log levelVariable

DEBUG, INFO, NOTICE, WARNING, ERR, CRIT, ALERT or EMERG.

Target
NFSEN_LOG_LEVEL
Default
INFO
Value
INFO
Import yearsVariable

Backfill window (years) processed on first start.

Target
NFSEN_IMPORT_YEARS
Default
3
Value
3