Here is some good news for network traffic analysis professionals. We just launched a new free and open source tool called “Netflow Loss Monitor” or nflossmon. You can download it from our GitHub repository https://github.com/trisulnsm/nflossmon
The Pain Point – Measuring NetFlow Feeds
In 2025, NetFlow is the dominant technology in network traffic measurement. If you are a traffic analyst in charge of a NetFlow based measurement system, then you will need to check if the NetFlow exports from the routers are being received without loss by the monitoring software.
Impact of NetFlow Packet Loss
NetFlow is a UDP based technology which means the end points do not keep track of missed packets and do not do retransmissions like TCP does. But within the NetFlow packet itself there is a sequence number field which is a running count of the flow exported from the device. This can be used to track flow loss on the NetFlow Analyzer side. What is the impact of NetFlow packet loss?
- Can lead to inaccurate reports
- When NetFlow is used for logging and compliance, lost packets can mean missed logs. This can be a problem with compliance.
- When NAT Translations transported via NetFlow are lost they can result in private IP not being tagged in the logs
Hence it is a best practice to measure and quantify the state of your NetFlow feeds.
Till date, there is no tool which can give you an accurate report on the state of your NetFlow feeds.
Enter nflossmon – Free and Open Source MIT license
In our product deployments we use a tool to measure the quality of the NetFlow streams, this has proved to be invaluable to us when faced with troubleshooting various complaints from our customers. We decided to open source this tool for the enjoyment of the entire Network Monitoring community.
Head over to our GitHub repo to download nflossmon
The README.md file gives a complete list of options and example commands to run the tool. The precompiled binary nflossmon will work on Ubuntu Focal (20.04) Jammy (22.04) and Noble (24.04). Others can simply compile the tool on their platforms.
Just Point it to an Interface or pcap File
You can run nflossmon by simply pointing to an interface where NetFlow feeds are coming in. It uses packet capture (libpcap) technology rather than UDP Port to measure the NetFlow traffic hence it can be used on a running system without disturbing it. It can also read from a PCAP file.
Example run:
To see the state of NetFlow on interface eth0
sudo ./nflossmon -i eth0
A periodic report is printed of all devices and within each device the sources or observation-domain-id. Losses greater than 5% are colored RED for your extra attention.
Timestamp: 2025-03-04 18:36:30
Device Version Source ID Loss (%) Expected Received
192.168.1.1 v9 200 0.00 496 496
192.168.1.2 v9 256 0.00 819 819
Hope this free tool is useful to the Network Monitoring community. Please provide feedback and suggestions to make it better.
Another interesting side about this tool is – we used Claude-3.5 to write about 60% of it. It is now an open secret that programmers are merely debugging and fine tuning the code written by AI.