nfsen-ng-nfcapd

nfsen-ng-nfcapd

Docker app from mbolli's Repository

Overview

NetFlow / sFlow / IPFIX collector (nfcapd) for nfsen-ng. It runs the nfcapd daemon from the nfsen-ng image, listening on a UDP port and writing rotated flow files that the nfsen-ng web UI reads. Point your router/switch flow exporter (pfSense/OPNsense/MikroTik/…) at this host on the collector port (default 9995/UDP). Mount this container on the SAME appdata path as the nfsen-ng UI, and make sure the write directory's last path segment (default "flows") matches one of the UI's Sources. This container has no web interface.

nfsen-ng

GitHub release GitHub license GitHub issues GitHub last commit GitHub stars PHP 8.4 OpenSwoole Docker Donate a beer

nfsen-ng is a modern, in-place replacement for the ageing NfSen web frontend. It sits on top of the existing nfdump tools and adds real-time SSE push, a responsive UI, and support for RRD or VictoriaMetrics as the storage backend.

Requires Linux. The backend runs on the OpenSwoole PHP extension, which has no maintained FreeBSD/other-BSD port — see openswoole/ext-openswoole#233. Docker images are Linux-only.

nfsen-ng dashboard overview, light and dark

nfsen-ng Sankey diagram visualizing src IP -> dst port -> dst IP traffic flow, light and dark Sankey traffic-flow diagram with the optional destination-port column, available since v1.0.0-beta.1.

Quick start

No clone needed — just grab the compose file and go:

curl -O https://raw.githubusercontent.com/mbolli/nfsen-ng/master/deploy/docker-compose.yml

# Edit NFSEN_SOURCES, NFSEN_NFDUMP_PROFILES, and other env vars in docker-compose.yml, then:

# Production with bundled Caddy (auto-HTTPS, ports 80/443)
docker compose --profile proxy up -d

# Production behind your own reverse proxy (app on port 9000 only)
docker compose up -d

The app image is published on GHCR: ghcr.io/mbolli/nfsen-ng. The bundled-Caddy profile uses the stock caddy:latest image — no custom build needed, since php-via serves and Brotli-compresses static assets itself. :latest tracks the newest release, betas included while pre-1.0; :edge always tracks the newest master build; or pin an explicit version tag from Releases for a fixed image.

Development (source mounted, auto-reload on file change):

git clone https://github.com/mbolli/nfsen-ng
cd nfsen-ng
docker compose -f deploy/docker-compose.dev.yml up -d

Set NFSEN_SOURCES, NFSEN_NFDUMP_PROFILES, and other options as environment variables in your compose file. See Installation and Configuration in the book for the full guide.

Documentation

The full user guide and developer reference now live in the nfsen-ng book — installation, configuration, every tab's feature docs, and the architecture/signals/SSE internals for contributors.

Migrating from the old v0.x NfSen-style release? See the upgrade guide in the book.

Install nfsen-ng-nfcapd on Unraid in a few clicks.

Find nfsen-ng-nfcapd in Community Apps on your Unraid server, review the template, and click Install. Unraid handles the Docker app or plugin setup from the published template.

Open the Apps tab on your Unraid server Search Community Apps for nfsen-ng-nfcapd Review the template variables and paths Click Install

Requirements

Install the nfsen-ng UI template too, and mount both containers on the SAME data path (default /mnt/user/appdata/nfsen-ng). The last segment of the write path (-w .../live/name, default "flows") must match one of the UI's NFSEN_SOURCES. A device on your network must export flows to this host's collector UDP port.

Related apps

Details

Repository
ghcr.io/mbolli/nfsen-ng:latest
Last Updated2026-07-09
First Seen2026-07-08

Runtime arguments

Network
bridge
Shell
bash
Privileged
false
Extra Params
--restart unless-stopped --entrypoint /usr/local/nfdump/bin/nfcapd

Template configuration

Collector portPortudp

UDP port nfcapd listens on. Configure your router's NetFlow/sFlow/IPFIX exporter to send here.

Target
9995
Default
9995
Value
9995
Data (profiles)Pathrw

Same data directory the nfsen-ng UI reads. nfcapd writes into live/source under it.

Target
/data/nfsen-ng
Default
/mnt/user/appdata/nfsen-ng
Value
/mnt/user/appdata/nfsen-ng
TimezoneVariable

Container timezone. Should match the UI container.

Target
TZ
Default
UTC
Value
UTC