nfdump

Send exporter records to the collector, then read its stored files with filters for the addresses, ports or other flow fields under investigation. nfdump separates collection from analysis and offers aggregation plus text, CSV, JSON or custom output. Sampling affects interpretation: the documented rate scales packet and byte counts, while flow counts are not multiplied. The 1.7 series reads files from 1.6.18 or later; older archives may need conversion before other tools can use them. The README says nfcapd has no built-in source access control, so restrict collector access at the host. These are exporter observations, with optional enrichment requiring its own databases.