FAIN SNAP provides an active network programming language and interpreter. It allows finite state machines to be operated over a number of network elements. Its main use is to program firewalls and raise alerts. It is a native Debian distribution.
Netflow analyzing tools :
JXColl - collector for Netflow (or XML specified) data
Analyzer - front-end application for providing an user interface and output (graphs, statistics, etc.)