Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Softflowd vs pfflowd

    Scheduled Pinned Locked Moved General pfSense Questions
    6 Posts 3 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W Offline
      wiz561
      last edited by

      Hi!

      I have a simple question…  What's the difference between softflowd and pfflowd, and which one should I be using?

      According to their web page...

      NB. If you are using OpenBSD, you may be interested in my pfflowd software instead. pfflowd uses the PF packet filter's stateful connection tracking to monitor flows rather than implementing it in software.

      Being that I'm new to networking, it sounds to me as if pfflowd is better to use because it does the same thing as softflowd, but it is 'built into' the OS.  To me, if it's built into the OS, there's a lower overhead and less memory and processor usage.

      Am I correct to think this, or is one better than the other?

      1 Reply Last reply Reply Quote 0
      • jimpJ Offline
        jimp Rebel Alliance Developer Netgate
        last edited by

        It's likely a matter of preference and whichever will output in a format you want with the features you need.

        softflowd isn't too hard to setup on pfSense:
        http://doc.pfsense.org/index.php/Exporting_NetFlow_with_softflowd

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • W Offline
          wiz561
          last edited by

          thanks for the info.  I got softflowd setup with pfsense and the data is exporting.  I don't have any complaints other than I'd like to exclude the dns flows, but that's not softflowd's problem.

          I was just wondering what the differences were (if any) and if one is preferred over the other.

          Thanks!

          1 Reply Last reply Reply Quote 0
          • C Offline
            cpk
            last edited by

            From what I can tell:

            pfflowd converts OpenBSD PF status messages to Cisco NetFlow™ datagrams.

            softflowd semi-statefully tracks traffic flows recorded by listening on a network interface or by reading a packet capture file.

            So, the main difference is how they collect data.

            I cannot find how to install pfflowd, so you may have to compile it yourself whereas softflowd can be installed using pkgadd (Instructions available at http://doc.pfsense.org/index.php/Exporting_NetFlow_with_softflowd.)

            1 Reply Last reply Reply Quote 0
            • jimpJ Offline
              jimp Rebel Alliance Developer Netgate
              last edited by

              pfflowd is already a package you can get under System > Packages.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • C Offline
                cpk
                last edited by

                Thanks for the information, Jim.

                One of my failures here was in not understanding that the forum search limits the results to the section being browsed.  Before I posted and while viewing this topic, I copied 'pfflowd' and pasted it into the search field – I found only the posts in this thread.  After I read your information, I did the same search while viewing the main page of the forum -- this time I found all of the threads on pfflowd.  Another lesson learned.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.