NetLens is a fast, Docker-based way to capture, store, and analyze NetFlow traffic from routers and switches — with a polished, password-protected web UI and no messy setup process.
Features
Collect raw NetFlow data and turn it into actionable traffic insights — without managing a complex stack by hand.
Listen on UDP ports 2055/2056 and collect NetFlow v5, v9, and IPFIX from routers, firewalls, and edge devices.
Keep flow data in real folders next to your stack — easy to inspect, back up, and rebuild, with no hidden Docker volumes.
Turn raw flows into readable RRD graphs and top-source summaries inside the built-in NfSen web interface.
Apply expire and max-size rules directly in the UI so the daemon keeps your data clean without manual cleanup.
How it works
Exports NetFlow data to your VPS over UDP.
Published UDP ports carry traffic into the container.
Raw flow files are written automatically per source.
RRD graphs and top-traffic summaries are generated.
Review charts, sources, and stats from the web UI.
Flow pipeline
Router
exports NetFlow v5 / v9 / IPFIX over UDP
VPS ports 2055 / 2056
Docker publishes the UDP ports into the container
nfcapd collector
writes one raw flow file per 5-minute window
nfsen-data/live/<router>/
raw flow files
nfsen-stat/live/<router>.rrd
RRD graphs
Web UI · :8070/nfsen.php
graphs, top talkers, and per-source drill-downs
Installation
Any VPS or Linux box with Docker — clone, build, and start collecting flow data right away.
# 1. Clone the repository
git clone https://github.com/rezwanvaiya2-0/netlens.git
cd netlens
# 2. Build and start NetLens
sudo ./install.shFirst run only
docker compose up -d starts the stack in seconds and keeps your sources, config, and data intact.First login
Open the dashboard
http://<YOUR_IP>:8070/nfsen.php
Username
admin
Password
change-me-now
Change the password immediately
One command, takes effect instantly — no restart needed:
docker exec netlens htpasswd -b /var/nfsen/etc/.htpasswd admin YourNewPass123Documentation
Deeper details for integrations, operations, and troubleshooting.
The web UI is password-protected and sessions auto-expire after one hour of inactivity. Read the security notes.