You should check IPT-NETFLOW, it seems exactly what you need implemented as a kernel module for IPTABLES. It is actively maintained and used succesfully in some ISP so should be good enough. Documentation could be better though (look into README file).


ntop will do it, but is probably not the best choice. Definitely check out pmacct; it's designed exactly for this. From the feature list:

  • Collects data through libpcap, Netlink/ULOG, NetFlow v1/v5/v7/v8/ - v9, sFlow v2/v4/v5 and IPFIX
  • Saves data to a number of backendsincluding memory tables, MySQL, PostgreSQL, SQLite and BerkeleyDB
  • Exports data to remote collectors through IPFIX, NetFlow v5/v9 andsFlow v5
  • Replicates incoming IPFIX, NetFlow and sFlow packets to remote collectors

Among many other things.


Here's a newer project for collecting and analyzing NetFlow data on Linux: ElastiFlow