NetLens

Docs

Adding a Router on a New Port

When you connect a router that sends NetFlow to a new UDP port, that port must be opened in docker-compose.yml and a matching source added to nfsen.conf. Both steps take about 3 seconds.

How it actually works (router to graph)

Router to graph

Your router

sends UDP NetFlow to the VPS

VPS port 2070

Docker publishes the UDP port into the container

nfcapd collector

started from the nfsen.conf source for that port

nfsen-data/live/<router>/

raw flow files

nfsen-stat/live/<router>.rrd

RRD graphs (every 5 min)

Web UI · :8070/nfsen.php

graphs, top talkers, and drill-downs

  1. Your router sends NetFlow to your VPS IP on a UDP port (e.g. 2070).
  2. Docker must forward that UDP port into the container — that is the ports: line in docker-compose.yml. Without it, the packets are dropped before NfSen ever sees them.
  3. nfcapd must listen on that port — that is the router source in nfsen.conf. nfsen reconfig starts one collector (nfcapd) per port automatically.
  4. nfcapd writes the raw flow files into /var/nfsen/profiles-data/live/<router>/ — which is your nfsen-data/live/<router>/ folder (bind mount).
  5. nfsend turns them into graphs (RRD files) in /var/nfsen/profiles-stat/live/.
  6. The Web UI (port 8070) reads those RRD files and draws the charts.

Step-by-step (example: new router on port 2070)

1. Open the port in docker-compose.yml

docker-compose.yml
ports:
  - "8070:8070"
  - "2055:2055/udp"
  - "2056:2056/udp"
  - "2070:2070/udp"      # <- new router port

2. Add the router source

docker exec is the recommended way, and it now persists forever:

add source
docker exec netlens bash -c "sed -i \"/^);$/i\\    'myrouter' => { 'port' => '2070', 'col' => '#FF0000', 'type' => 'netflow' },\" /var/nfsen/etc/nfsen.conf && /var/nfsen/bin/nfsen reconfig && echo 'Done'"

Prefer the env var? You can set NFSEN_SOURCES=2070:myrouter:#FF0000 in docker-compose.yml instead — but pick one method, don't mix.

3. Recreate the container — done

apply
docker compose up -d

That's it: the port opens and the router source is configured automatically. Takes ~3 seconds.

No rebuild, no data loss

The image is not rebuilt — only the container is recreated, fast and safe. docker compose up -d keeps all your NetFlow data (it lives in the nfsen-data/ folder next to docker-compose.yml).

What each step did

  1. Adding - "2070:2070/udp" to ports: makes Docker start forwarding UDP 2070 from the VPS into the container.
  2. The docker exec command adds the 'myrouter' source to nfsen.conf (which lives in nfsen-etc/ on the host) and runs nfsen reconfig — reconfig starts an nfcapd collector on port 2070 and creates the nfsen-data/live/myrouter/ folder.
  3. docker compose up -d recreates the container so the new port mapping takes effect (the image is not rebuilt).

Replace or remove the demo router1 source

The container ships with a demo source router1 on port 2055 so the Web UI shows graphs on first install. Remove or replace it once you connect a real router:

remove demo source
docker exec netlens bash -c "sed -i \"/'router1' =>/d\" /var/nfsen/etc/nfsen.conf && /var/nfsen/bin/nfsen reconfig && echo 'Removed'"

Keep the demo gone permanently

To keep the demo gone permanently, keep at least one real source. If your %sources list ever becomes completely empty (e.g. you remove router1 and have no other routers yet), the demo is re-seeded automatically on the next container start. Once you have any real router, the demo never comes back.