phaag

nfdump Filter Syntax Cheatsheet

The nfdump filter syntax is similar to tcpdump, but it is adapted and extended for NetFlow and IPFIX records.
This cheatsheet provides both a learning-friendly introduction and a complete reference for filter usage in nfdump.

---

🧭 Getting Started with Filters

A filter defines which flow records should be matched or displayed.

phaag

Keybase proof

I hereby claim:

• I am phaag on github.
• I am ultrix (https://keybase.io/ultrix) on keybase.
• I have a public key ASB3MPstoKM89MdDV8PZpC_B0VJ-2y5xSAovgk14q0wZZQo

To claim this, I am signing this object: