NetLens — Dockerized NfSen NetFlow Analyzer

What is NetLens?

NetLens packages the classic NfSen + NfDump NetFlow analysis stack into a single Docker container — production-grade traffic analysis without manual compiling and dependency management.

Collect

nfcapd listens on UDP ports 2055/2056 (plus any port you add) and captures NetFlow v5/v9/IPFIX from your routers.

Store

Flow data lives in bind-mounted folders next to docker-compose.yml — visible, browsable, and it survives rebuilds.

Visualize

The Web UI (port 8070) turns raw flows into RRD graphs — traffic, flows, and packets per source, behind a styled login page.

Retain

Set Expire / Max size per profile from the Web UI. The nfsend daemon enforces it automatically — no cron, no config edits.

How it works

From your router to a graph on screen — one clean pipeline.

# The flow pipeline
Your router ──UDP NetFlow──► VPS port 2055/2056 ──Docker port publish──► container
      ──nfcapd collector──► nfsen-data/live/<router>/   (raw flow files)
      ──nfsend (every 5 min)──► nfsen-stat/live/<router>.rrd  (graphs)
      ──► Web UI  http://YOUR_IP:8070/nfsen.php

Router sends NetFlow

Your router exports NetFlow v5/v9 to your VPS IP on a UDP port.

Docker forwards the port

The ports: line in docker-compose.yml publishes it into the container — without it, packets are dropped.

nfcapd collects

One collector per port (from the router sources in nfsen.conf) writes raw flow files every 5 minutes.

nfsend graphs them

The daemon turns the flows into RRD files, and the Web UI draws the charts.

Installation

Up and running in three commands. You need a VPS or server with Docker (Compose v2). First install takes a few minutes to build.

Quick start

# 1. Clone the repository
git clone https://github.com/rezwanvaiya2-0/netlens.git
cd netlens

# 2. Build & start (same as: docker compose up -d --build)
sudo ./install.sh

First run only: the --build flag is needed just once. After that, docker compose up -d starts the container in seconds — your sources, config, and data persist in the folders next to docker-compose.yml.

Access the Web UI

Open http://<YOUR_IP>:8070/nfsen.php in your browser. The UI is password-protected — first login:

Username	`admin`
Password	`change-me-now`

Change the password immediately — one command, takes effect instantly, no restart needed:

docker exec netlens htpasswd -b /var/nfsen/etc/.htpasswd admin YourNewPass123

Data folders

Your data lives in 4 real folders next to docker-compose.yml — no hidden Docker volumes:

Folder	Inside the container	Holds
`nfsen-data/`	`/var/nfsen/profiles-data`	Raw NetFlow capture files
`nfsen-stat/`	`/var/nfsen/profiles-stat`	RRD graph files (the charts)
`nfsen-var/`	`/var/nfsen/var`	Logs, cache, runtime files
`nfsen-etc/`	`/var/nfsen/etc`	`nfsen.conf` (router sources)

Back up anytime: tar czf nfsen-backup.tar.gz nfsen-data nfsen-stat nfsen-var nfsen-etc
Data survives everything — rebuilds, restarts, even docker compose down -v
Only rm -rf on the folders themselves deletes data (stop the container first)

Connect a router

UDP ports 2055 and 2056 are pre-opened, with a demo router1 source so the UI shows graphs on first install. To add a router on a new port:

# 1. Open the port in docker-compose.yml under ports:
#    - "2070:2070/udp"

# 2. Add the router source (persists forever)
docker exec netlens bash -c "sed -i \"/^);$/i\\    'myrouter' => { 'port' => '2070', 'col' => '#FF0000', 'type' => 'netflow' },\" /var/nfsen/etc/nfsen.conf && /var/nfsen/bin/nfsen reconfig"

# 3. Recreate the container (~3 seconds, no rebuild, no data loss)
docker compose up -d

Set data retention

From the Web UI: Profile Admin → live profile → Edit. Set Expire (max age, e.g. 3d) and Max size (hard disk cap, e.g. 44G), then Save. The daemon enforces it automatically within minutes.

See your network flows clearly