nfdump

nfdump -R <path> -o extended 'src ip <ip>'

Query NetFlow files with nfdump, filtering flows by IP, port, or protocol to reconstruct the attacker's communications.

Run it when you have NetFlow (exported by routers or with nprobe) and need to answer 'who did this IP talk to?': nfdump queries flow files with filters by source/destination IP, ports, protocols, and times, and shows flows with their volume. It's the network IR tool when there's no pcap: flows give metadata of ALL connections (who, with whom, how much, when) even if content is encrypted or capture doesn't exist. Typical case: the compromised IP and its communications with C2, or the attacker's IP and its contacts on the network — the lateral movement map without pcap.

Don't use it for content: flows are metadata — you know there were 890MB between two IPs, not what was transmitted; for content you need pcap or application logs. Quality depends on export: if routers don't export (or export sampled), flows are incomplete and answers partial. And watch the format: nfdump works with nfdump/nfcapd files — raw NetFlow from other collectors requires conversion. Queries over wide file ranges take time: narrow with dates (-R points to directory, time filters within the query) and with just the right fields.