---
name: "nfreplay"
section: "1"
platform: "linux"
package: "nfdump"
version: "1.7.5-2+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/nfreplay"
---

# nfreplay(1)

replay binary flow files as netflow version v5 or v9 to a remote host

## NAME

**nfreplay** – replay binary flow files as netflow version v5 or v9 to a remote host

## SYNOPSIS

**nfreplay** **-r** *flowfile* **-H** *remotehost* **-p** *port* \[**-S** *Sourceaddr*\] \[**-j** *mcastgroup*\] \[**-4**\] \[**-6**\] \[**-v** *version*\] \[**-d** *usec*\] \[**-b** *buffsize*\] \[**-z** *num*\] \[**-c** *num*\] \[**-v**\] \[**-H**\] \[*filter*\]

## DESCRIPTION

**nfreplay** reads binary flow files stored by any nfdump collector and sents the flow records to a remote host or a multicast group.

**nfreplay** sends the data as netflow v5 or v9 to the remote location.

**nfreplay** accepts a filter to limit the flows to be sent. The filter syntax is equivalent to nfdump.

The options are as follows:

- **-r** *flowfile*

  Read input data from *flowfile.*

- **-H** *remotehost*

  Send all flows to this remote host. Accepts a symbolic name or a IPv4/IPv6  IP address.

- **-j** *mcastgroup*

  Join this multicast group and send all flows to this group host. Accepts a  symbolic name or multicast IPv4/IPv6 IP address.

- **-p** *port*

  Send all flows to this port on the remote side. Default is 9995.

- **-S** *Sourceaddr*

  Use the specified source IP address to send the flows

- **-4**

  Forces **nfreplay** to send flows to a IPv4 address only. Can be used if the remote host has an IPv4 and IPv6 address record.

- **-6**

  Forces **nfreplay** to send flows to a IPv6 address only. Can be used if the remote host has an IPv4 and IPv6 address record.

- **-v** *version*

  Send flows as netflow version *version*. Version V5 and v9 are supported. In v5 mode, all additional elements to a  stadard v5 record are skipped and 64bit counters are truncated to 32bit.  The default is v9.

- **-u** *usec*

  Delay each record by *usec* mirco seconds, to avoid overrun on the remote host. Default is 10usec.

- **-B** *buffsize*

  Set send buffer to *buffsize* size in bytes. Useful to buffer larger data transfers.

- **-z** *num*

  Flows are sent with their "real distribution" acrross time (with a speed coefficient)

  -

    **-z** 1 : 5 minutes of records will be sent in 5 minutes. **-** z 20 : 5 minutes of record will be sent in 5/20 = 0.25 minutes.

- **-c** *num*

  Limit number of records to send to the first  *num* flows.

- **-V**

  Print **nfreplay** version and exit.

- **-h**

  Print help text on stdout with all options and exit.

## RETURN VALUES

-

  255 Initialization failed.

-

  254 Error in filter syntax.

-

  250 Internal error.

**nfreplay** returns

## SEE ALSO

[nfdump(1)](/nfdump/1.md) [nfcapd(1)](/nfcapd/1.md)