# nfstream/nfstream

NFStream: a Flexible Network Data Analysis Framework.

Repository: https://github.com/nfstream/nfstream
Canonical: https://ross.abutalabs.com/products/nfstream
Homepage: https://www.nfstream.org
Language: Python
License: LGPL-3.0
License Family: copyleft
Topics: data-science, data-analysis, data-mining, network-analysis, network-security, network-monitoring, cybersecurity, machine-learning, artificial-intelligence, dataset-generation, deep-packet-inspection, netflow, traffic-analysis, traffic-classification, pcap, packet-capture, packet-analyser, python, ndpi
Last push: 2026-08-17T15:03:00+00:00

## Health v2 (maintenance only)
Score: 81/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 47, longevity 100
- inputs: {"age_days": 2511, "days_push": 16, "days_rel": 199, "gap_med": 91, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1218, forks 145 (observed 2026-08-28T04:04:01.622669+00:00)

## What it is
NFStream is a multiplatform Python framework for fast, flexible network flow data analysis from live interfaces or pcap files. It provides flow metering, nDPI-based encrypted layer-7 identification, statistical feature extraction, and extensible NFPlugin support aimed at reproducible machine learning research.

## Use cases
- extract network flows from a large pcap file into pandas or csv
- identify encrypted applications in live traffic with nDPI
- extract statistical flow features for machine learning traffic classification
- capture flows from a network interface in python
- add custom flow features with a plugin
- generate reproducible network traffic datasets for research
- fingerprint TLS and SSH metadata from traffic

## When to choose
- you need fast python-based flow aggregation from pcaps or live interfaces
- you want layer-7 application identification including encrypted traffic
- you are building ML models for network traffic management and need reproducible features
- you need extensible flow feature extraction via plugins

## When to avoid
- you need full packet-level inspection rather than flow-level analysis
- you need a GUI packet analyzer like Wireshark
- you require a permissive license for proprietary linking (LGPL-3.0)
- you need non-python tooling

## Facets
- artifact type: framework
- maturity: stable
- function: nlp, machine-learning, data-science, etl, analytics, developer-tools
- domain: networking, security, data-science, machine-learning, analytics, developer-tools
- platform: python, windows, cross-platform
- tags: network-analysis, pcap, netflow, deep-packet-inspection, ndpi, traffic-classification, packet-capture, network-monitoring, flow-features, nfplugin, linux, macos

## Member repositories
- nfstream/nfstream (main) score 81

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:01.622669+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:17:04.682172+00:00, confidence not recorded.
  - readme: https://github.com/nfstream/nfstream (fetched 2026-08-28T04:04:01.622669+00:00, sha 94d7798c0e40)
  - homepage: https://www.nfstream.org (fetched 2026-08-29T12:25:03.056699+00:00, sha d5e8f6c3dba0)
  - site_page: https://www.nfstream.org/docs/releases (fetched 2026-08-29T12:25:03.073914+00:00, sha 76fe34120298)
  - site_page: https://www.nfstream.org/docs/license (fetched 2026-08-29T12:25:03.075971+00:00, sha 3bd593d6a2b3)
  - site_page: https://www.nfstream.org/docs (fetched 2026-08-29T12:25:03.065707+00:00, sha c6d20bcced8b)
  - site_page: https://www.nfstream.org/docs/design (fetched 2026-08-29T12:25:03.067702+00:00, sha 51c7a6bcc5df)
  - site_page: https://www.nfstream.org/docs/api (fetched 2026-08-29T12:25:03.069709+00:00, sha 012d63c03011)
  - site_page: https://www.nfstream.org/docs/community (fetched 2026-08-29T12:25:03.071920+00:00, sha 7a82ff994327)
- Data as of 2026-08-30T08:39:29.467469+00:00.