NFPCAPD(1)

💅 NFPCAPD — the pcap-to-netflow daemon, bestie edition 🎀

okay so this whole page is about nfpcapd, which lives in the General Commands Manual section on this Debian build — and honestly? she's iconic. let's get into it ✨

---

✨ SYNOPSIS ✨

nfpcapd [-i interface] [-r file] [-s snaplen] [-B cachesize]
        [-e active,inactive] [-I ident] [-w flowdir] [-p pcapdir]
        [-H host[/port]] [-S num] [-t interval] [-P pidfile] [-D] [-d]
        [-v level] [-u userid] [-g groupid] [-o option[,option]]
        [-C config] [-m socket] [-z=lzo] [-z=bz2] [-z=lz4[:level]]
        [-z=zstd[:level]] [-j] [-y] [-l flowdir] [-T] [-W workers] [-V]
        [-h] ['<filter>']

---

🌸 DESCRIPTION 🌸

so nfpcapd is literally the pcap capture daemon of the nfdump tools, no cap. it reads network packets — either from an interface or from a file — and directly creates nfdump records. those records get written either locally to a directory in the same format as nfcapd, or they can be forwarded to an nfcapd collector somewhere else out there in the network 🦋

basically nfpcapd is nfcapd's pcap sibling and she shares so many options and generates the same type of files. like, nfpcapd likewise creates, rotates and stores files. if you want the full tea on the common options, go read nfcapd(1) — that's the mutual bestie of this page 💖

nfpcapd optionally also stores pcap traffic data in separate files and uses the same rotation interval as for the netflow data. important though: storing pcap traffic data files is only possible locally 🫶

also she's multithreaded! nfpcapd uses separate threads for packet, netflow and pcap processing. main character energy, honestly 👑

---

💅 OPTIONS 💅

• -i interface — listen on this interface in promisc mode for packet processing.
• -r file — read and process packets from a classic PCAP file with microsecond timestamps. heads up: PCAPNG and nanosecond-resolution PCAP files are not supported 🙈 a gzip-compressed classic PCAP file is accepted when nfpcapd was built with zlib support.
• -s snaplen — limit the snaplen on collected packets. default is 1522 bytes. the snaplen needs to be large enough to process all required protocols, and it must not be smaller than 54 bytes.
• -B cachesize — sets the initial node cache size. by default the cache size is set to 8192 nodes, and it grows and shrinks dynamically ✨
• -e active,inactive — sets the active and inactive flow expire values in seconds. default is 300,60.
  • Active timeout: a flow gets flushed to disk after this period even if it's still active. rule of thumb: it should correspond with the -t rotation value, in order to reflect continuous traffic in the flow files.
  • Inactive timeout: a flow gets flushed to disk after being inactive for this number of seconds. it frees up node resources.
  • on busy networks these values can be set to more aggressive timeouts 💀
• -I ident — specifies an ident string, which describes the source, e.g. the name of the interface or host. this string is put into the stat record to identify the source. default is 'none'. same as nfcapd(1).
• -w flowdir — specifies the base directory to store the flow files. if a sub hierarchy is specified with -S, the final directory is concatenated to base_directory/sub_hierarchy.
• -p pcapdir — optionally stores network packets in pcap compatible files in this directory and rotates files the same as the flow files. sub hierarchy directories are applied likewise.
• -H host[/port] — send nfdump records to a remote nfcapd collector. default port is 9995. flows are no stored locally.
• -S num — allows you to specify an additional directory sub hierarchy to store the data files. default is 0, no sub hierarchy, which means the files go directly in the base directory (-w). the base directory (-w) is concatenated with the specified sub hierarchy format to form the final data directory. for a full list of hierarchies see nfcapd(1).
• -t interval — specifies the time interval in seconds to rotate files. default value is 300s (5min). the smallest interval can be set to 2s. the intervals are in sync with wall clock ⏰
• -P pidfile — specify name of pidfile. default is no pidfile.
• -D — daemon mode: fork to background and detach from terminal. nfpcapd terminates on signal TERM, INT and HUP.
• -d — de-duplicate packets with a window size of 8. this option is useful if packets in a pcap file are duplicated for some unknown reason 🙈 if packets on multiple span ports are sent to the collector they got de-duplicated within the window size. Note: the de-duplication works on the IP layer to the end of the packet, which means layer 1 and VLAN/MPLS layers are stripped. if used together with -p, the resulting pcaps are de-duplicated as well.
• -v level — set verbose level. accepted 0 to 4. default level is 1 with moderate information. use -v 3 to printf netflow records in raw format while collecting. please note that not all elements are printed — this option is for debugging purpose only, to verify if incoming netflow data is processed correctly 🔍
• -u userid — change to the user userid as soon as possible. only root is allowed to use this option. Uid/Gid is switched after opening the reading device.
• -g groupid — change to the group groupid as soon as possible. only root is allowed to use this option. Uid/Gid is switched after opening the reading device.
• -o option[,option] — adds options to nfpcapd. two options are available:
  • fat — add Mac addresses, optional Vlan and MPLS labels.
  • payload — add the payload bytes of the first packet of a connection.
• -z=lzo — compress flows. use fast LZO1X-1 compression in output file.
• -z — legacy shorthand for -z=lzo.
• -z=bz2 — compress flows. use bz2 compression in output file. Note: not recommended while collecting.
• -z=lz4[:level] — compress flows. use LZ4 compression in output file.
• -z=zstd[:level] — compress flows. use zstd compression in output file.
• -j — legacy shorthand for -z=bz2.
• -y — legacy shorthand for -z=lz4.
• -l flowdir — legacy alias for -w flowdir.
• -T — legacy option accepted and ignored.
• -C config — read configuration from config; use null to suppress configuration-file loading.
• -m socket — enable the metrics exporter on socket.
• -W num — set the number of worker threads. the default depends on the number of cores online. the value must not exceed the number of online CPU cores.

worker threads are used to compress data blocks when writing flow files to disc. using multiple workers can significantly improve throughput, especially when using higher compression levels for lz4 or zstd 🔥

• -V — print nfpcapd version and exit.
• -h — print help text to stdout with all options and exit.
• '<filter>' — optional pcap compatible packet filter. the filter needs to be put within quotes.

---

⭐ EXIT STATUS ⭐

nfpcapd returns 0 on success, or 255 if initialization failed. simple as that 💜

---

🦋 LOGGING 🦋

nfpcapd logs to syslog with SYSLOG_FACILITY LOG_DAEMON. for normal operation level 'error' should be fine. more information is reported at level 'info'.

a small statistic about the collected flows, as well as errors, are reported at the end of every interval to syslog with level 'info' 📊

---

🌈 EXAMPLES 🌈

read packets from interface eth0:

nfpcapd -i eth0 -z=zstd -D -w /netflow/flows -S 2 -I any -P
/var/run/nfpcapd.pid

read packets from interface mx0 and store also packets in pcap files:

nfpcapd -i vmx0 -z=lz4 -D -w /netflow/flows -p /netflow/caps

send records to a remote host:

nfpcapd -i eth1 -H 192.168.200.10/12344 -D -e 60,20 -o fat,payload

---

🧚 NOTES 🧚

nfpcapd can store records either locally or send it to a remote host but not both at the same time. pick a lane, bestie 💅

if records are sent to a remote nfcapd process, both programs nfcapd and nfpcapd must be of the same endian architecture (both big or little endian). nfpcapd uses netflow version 250 (nfdump's native record format) for sending flows. no cap, this one matters 😭

the flow cache is checked in regular 10s intervals and expires flows according to the expire values. expired flows are flushed and processed and nodes are freed up.

a smaller snaplen may improve performance, but may result in loss of information. the smallest snaplen of 54 bytes can process regular TCP/UDP/ICMP packets. in case of Vlan or MPLS labels, not enough information may be available for correct protocol decoding. nfdump records may be incomplete and set to 0 🙈

if IP packets are fragmented, they are reassembled before processing. all IP fragments need to be reassembled in order to be passed to the next stage. if not all fragments are correctly assembled within 15s since the first fragment arrived, all fragments are discarded. brutal but fair 💀

---

👑 SEE ALSO 👑

nfcapd(1), nfdump(1), nfexpire(1) — the whole friend group, go say hi 🫶

---

💀 BUGS 💀

no software without bugs! please report any bugs back to me. that's the whole section, she's short and honest 🍓

---

and that's the page, bestie 💖 this one shipped out on Debian, with the date stamped as $Mdocdate$ in the footer — so if you're reading it, that's where it came from 🌸 mwah, go capture some packets ✨