NetLens

Docs

Introduction

NetLens packages the classic NfSen NetFlow analyzer with the modern convenience of Docker — one command to deploy, real folders for your data, and a password-protected web UI.

What is NetLens?

NetLens is a Dockerized NfSen NetFlow Analyzer. It bundles NfSen 1.3.6p1 and NfDump 1.6.17 on Ubuntu 20.04 into a single, self-contained container that collects, stores, and visualizes NetFlow data. One command — sudo ./install.sh — builds the image, creates your data folders, and starts the analyzer on port 8070.

What's inside

  • NfSen 1.3.6p1 — the web frontend: graphs, details, alerts, and profile administration.
  • NfDump 1.6.17 — collection and analysis tools (nfcapd, nfdump, nfexpire, …).
  • Apache 2.4 + PHP 7.4 — serving the web UI with a styled login page (mod_auth_form).
  • Bind-mounted data folders — your flow data lives in real folders next to docker-compose.yml, not in hidden Docker volumes.

How the stack works

Routers and switches export NetFlow (v5, v9, or IPFIX) over UDP to ports you publish into the container. Each configured source runs an nfcapd collector that writes raw flow files to nfsen-data/live/<source>/. The nfsend daemon converts those files into RRD graphs in nfsen-stat/live/, and the web UI renders everything at http://<YOUR_IP>:8070/nfsen.php.

Flow pipeline

Router

exports NetFlow v5 / v9 / IPFIX over UDP

VPS ports 2055 / 2056

Docker publishes the UDP ports into the container

nfcapd collector

writes one raw flow file per 5-minute window

nfsen-data/live/<router>/

raw flow files

nfsen-stat/live/<router>.rrd

RRD graphs

Web UI · :8070/nfsen.php

graphs, top talkers, and per-source drill-downs

What makes it different

  • Real folders, not volumes. Four folders next todocker-compose.yml (nfsen-data/, nfsen-stat/, nfsen-var/, nfsen-etc/) hold everything. You can browse, back up, and mount them freely — data survives rebuilds, restarts, and even docker compose down -v.
  • Works out of the box. A demo source router1 on port 2055 ships by default, so the web UI shows graph placeholders from the first install.
  • Password-protected UI. Apache mod_auth_form serves a styled login page, and sessions auto-expire after one hour of inactivity.
  • Add routers in seconds. Open a UDP port and add a source — about three seconds, no image rebuild, no data loss.

When to use NetLens

You manage one or more routers, firewalls, or edge devices and want a lightweight, self-hosted traffic analysis tool. NetLens is ideal for a small to medium network where a full commercial NetFlow collector is overkill but tcpdump is not enough. The web UI gives you graphs, top talkers, and per-source drill-downs, and the same data can be shared read-only with LibreNMS for unified monitoring.

Next steps

Technology credits

This project is a Dockerized packaging of two open-source projects — all credit for the NetFlow analysis itself goes to NfSen and NfDump. The repository itself is released under the BSD-3-Clause license.