I like ntop; but the version available through most OEes is the old
version (the old version did not have a integrated database/save
feature). The new version (I believe) requires a paid license.
I use nfsen on my collector, the router dumps in netflow v5 - using the
softflowd software packaged with LEDE.
I'll search for a 'white paper' on the format/syntax of the output data.
- Lynwood
KB3VWG