Introduction

nfsen-ng is a modern, in-place replacement for the ageing NfSen web frontend. It sits on top of the existing nfdump tool suite and adds real-time SSE push, a responsive UI, and a choice of RRD or VictoriaMetrics as the storage backend — without changing how nfcapd itself captures traffic.

Who this is for

Anyone already running (or migrating from) NfSen/nfdump to monitor NetFlow traffic: source/destination breakdowns, protocol and port distributions, flow search, and threshold alerting, all served from the nfcapd files nfdump already writes.

The shape of the app

nfsen-ng is a single-page application: one route (/) serves the whole UI, and every “page” the nav bar shows — Graphs, Flows, Statistics, Sankey, Settings — is a client-local view switch, not a server round-trip. The server side is PHP 8.4 running on OpenSwoole coroutines via a small in-house framework (php-via), pushing UI updates to the browser over Server-Sent Events using Datastar. There’s no separate REST API and no client-side framework build step: the server renders Twig templates, and Datastar patches the DOM.

To get it running, start with Installation and Configuration. The Architecture chapter covers how these pieces fit together; Features walks each screen; and Development covers running it locally.

OpenSwoole’s FreeBSD/other-BSD port is unmaintained (openswoole/ext-openswoole#233), so nfsen-ng currently requires Linux.

Status

This book documents the v1.0.0-beta.2 line — see the Roadmap for what’s tracked and what’s next.