Deployment
NetFlow Optimizer (NFO) scales from a single virtual machine to a distributed cluster. This page covers what you need before you install: host requirements, network ports, and which architecture to choose. It then points you to the installation guide for your platform.
Choosing an Architecture
Most deployments are single-node. Move to a distributed architecture when data volume, network segmentation, or availability requirements call for it.
| Architecture | Use it when |
|---|---|
| Single node | Standard choice. NFO and the External Data Feeder run on one host. |
| Separate External Data Feeder | The NFO host has no outbound internet access, so the feeder runs in a DMZ and pushes updates inward. |
| NFO Central with peers | Flow volume exceeds what one node can process, or you need high availability. Linux only. |
For a full comparison, including cloud and hybrid scenarios, see Deployment Architecture and Strategy.
Host Requirements
These requirements apply to any node running NetFlow processing modules: a single-node instance or an NFO Peer.
| Component | Minimum | Recommended for production |
|---|---|---|
| CPU | 2 cores | 4 to 8 cores |
| Memory | 8 GB RAM | 16 GB RAM, which gives enrichment room to work |
| Disk space | 20 GB | 100 GB or more, for logs and local caching |
| OS (Linux) | RHEL or Rocky 8 and later, Ubuntu 20.04 and later | RHEL 9 or Rocky Linux 9 |
| OS (Windows) | Windows Server 2016 | Windows Server 2022 |
NFO Central does not run NetFlow processing modules, so its resource profile differs from a processing node. It distributes flows to peers rather than processing them itself, which is why a single NFO Central handles a substantially higher flow rate than a single processing node. See NFO Central for distributed deployment guidance.
Network Ports
| Purpose | Port |
|---|---|
| Flow ingestion (NetFlow, IPFIX, sFlow) | UDP 9995 |
| Web interface and management | TCP 8443 |
| Enrichment updates, outbound from the External Data Feeder to the internet | TCP 443 |
Installation Guides
Single node (NFO with built-in External Data Feeder)
- Linux, for RPM and TAR.GZ deployments
- Windows, using the installer for Windows Server
- AWS, launching from the Amazon Machine Image
Distributed components
- Standalone External Data Feeder, needed only when the NFO host cannot reach the internet
- NFO Central, for scaling across multiple nodes under one management interface
After Installing
Once the software is installed and your network devices are exporting flows, verify the pipeline end to end: ingestion, enrichment, and output. See Deployment Validation.
Frequently Asked Questions
Do I need to install the External Data Feeder separately?
No. Since NFO 2.7 the External Data Feeder is bundled with NFO. A separate installation is needed only when the NFO server cannot reach the internet to download threat lists and GeoIP updates.
Can I run NFO as a non-root user?
Yes. See Running as Non-Root for the post-install steps.
NFO Central and any node running Repeater functionality must run with root privileges, because they forward NetFlow packets while preserving the original exporter's IP address.