NFREPLAY(1)

💅 NFREPLAY(1) — General Commands Manual ✨

okay so this is the nfreplay page, from the General Commands Manual section, and bestie… it's literally the glow-up tool for your flow files 🦋

---

✨ NAME ✨

nfreplay — replay binary flow files as netflow version v5 or v9 to a remote host 💌

---

🎀 SYNOPSIS 🎀

nfreplay -r flowfile -H remotehost [-i remotehost] -p port
         [-S Sourceaddr] [-j mcastgroup] [-4] [-6] [-v version]
         [-d usec] [-b buffsize] [-z num] [-c num] [-f filterfile]
         [-t timewin] [-E] [-L logfile] [-Y] [-V] [-h] [filter]

---

🌸 DESCRIPTION 🌸

nfreplay reads binary flow files that any nfdump collector stored, and sends those flow records off to a remote host or a multicast group. it's giving delivery service, no cap 📦

so like, nfreplay sends the data as netflow v5 or v9 to wherever the remote location is. slay 💅

and it also accepts a filter to limit which flows actually get sent — the filter syntax is equivalent to nfdump's. same vibes, same syntax, iykyk 👑

the options are as follows, and yes i'm listing every single one because we don't skip 👇

---

💖 OPTIONS 💖

• -r flowfile — read input data from flowfile. that's your source, your origin story, your main character 📖
• -H remotehost — send all flows to this remote host. accepts a symbolic name or an IPv4/IPv6 IP address 🛰️
• -j mcastgroup — join this multicast group and send all flows to this group host. accepts a symbolic name or multicast IPv4/IPv6 IP address 🫂
• -p port — send all flows to this port on the remote side. default is 9995 🚪
• -S Sourceaddr — use the specified source IP address to send the flows 🪪
• -4 — forces nfreplay to send flows to a IPv4 address only. can be used if the remote host has an IPv4 and an IPv6 address record 🍀
• -6 — forces nfreplay to send flows to a IPv6 address only. can be used if the remote host has an IPv4 and an IPv6 address record 🔮
• -v version — send flows as netflow version version. versions 5, 9 and 250 are supported. in v5 mode, all additional elements to a standard v5 record are skipped and 64bit counters are truncated to 32bit 😭 (yes, lossy, we said it). version 250 sends flows in nfdump's own native record format, as used between nfcapd and nfpcapd, without any conversion or loss of precision — full fidelity icon behavior 💎. the default is v9 ⭐
• -d usec — delay each record by usec microseconds, to avoid overrun on the remote host. default is 1 microsecond ⏱️
• -b buffsize — set send buffer to buffsize size in bytes. useful to buffer larger data transfers 🧺
• -z num — flows are sent with their "real distribution" across time (with a speed coefficient):
  • -z 1 : 5 minutes of records will be sent in 5 minutes 🐢
  • -z 20 : 5 minutes of record will be sent in 5/20 = 0.25 minutes 🐇
• -c num — limit number of records to send to the first num flows ✂️
• -f filterfile — read the flow filter from filterfile 📄
• -t timewin — restrict replay to an nfdump time-window expression ⏳
• -E — enable diagnostic verbosity (equivalent to verbosity level 1) 🗣️
• -L facility — log diagnostic output to syslog facility facility instead of stderr 📝
• -i remotehost — compatibility alias for -H. same thing, different letter, we love a legacy moment 🫶
• -Y — require confirmation before sending flows. consent check, we stan 🙈
• -V — print nfreplay version and exit 🏷️
• -h — print help text on stdout with all options and exit 🙋‍♀️

---

🔥 EXIT STATUS 🔥

nfreplay returns:

• 255 — initialization failed 💀
• 254 — error in filter syntax 🚫
• 250 — internal error 😵‍💫

---

🦋 SEE ALSO 🦋

nfcapd(1), nfdump(1) — go read your sisters' pages, bestie, they're iconic too 👑👑

---

<div>okay that's the whole page!! this build is the Debian one, version string is literally $Mdocdate$, and it lives in section NFREPLAY(1) of the General Commands Manual — so like, cite it properly when you quote it in the group chat 🎀✨🫶</div>