NAME

rwipfix2silk - Convert IPFIX records to SiLK Flow records

SYNOPSIS

  rwipfix2silk [--silk-output=FILE] [--print-statistics]
        [--interface-values={snmp | vlan}]
        [--note-add=TEXT] [--note-file-add=FILE]
        [--compression-method=COMP_METHOD] [IPFIX_FILES...]

  rwipfix2silk --help

  rwipfix2silk --version

DESCRIPTION

rwipfix2silk reads IPFIX (Internet Protocol Flow Information eXport) records from the input files specified on the command line or from the standard input when no files are specified, converts the records to the SiLK Flow format, and writes the SiLK records to the path specified by --silk-output or to the standard output when stdout is not the terminal and --silk-output is not provided.

When stdin or - is provided as an input file name, rwipfix2silk will read records from the standard input.

OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--silk-output=FILE

Write the SiLK records to FILE, which must not exist. If the switch is not provided or if FILE has the value stdout or -, the SiLK flows are written to the standard output.

--print-statistics

Print, to the standard error, the number of records that were written to the SiLK output file, and the number of forward and reverse records that were seen.

--interface-values={snmp | vlan}

Specify which IPFIX fields should be stored in the input and output fields of the generated SiLK Flow records. If this switch is not specified, the default is snmp. The choices are:

snmp

Store the indexes of the network interface cards where the flows entered and left the router. That is, store the ingressInterface in input and the egressInterface in output.

vlan

Store the VLAN identifiers for the source and destination networks. That is, store vlanId in input and postVlanId in output. If only one VLAN ID is available, input is set to that value and output is set to 0.

--note-add=TEXT

Add the specified TEXT to the header of the output file as an annotation. This switch may be repeated to add multiple annotations to a file. To view the annotations, use the rwfileinfo(1) tool.

--note-file-add=FILENAME

Open FILENAME and add the contents of that file to the header of the output file as an annotation. This switch may be repeated to add multiple annotations. Currently the application makes no effort to ensure that FILENAME contains text; be careful that you do not attempt to add a SiLK data file as an annotation.

--compression-method=COMP_METHOD

Set the compression method of the output to COMP_METHOD. Some SiLK tools can use an external library to compress their binary output. The list of available compression methods and the default method are set when SiLK is compiled (the --help and --version switches print the available and default compression methods) and depend on which supported libraries are found. SiLK can support:

none

Do not compress the output using an external library

zlib

Use the zlib(3) library for compressing the output

lzo1x

Use the lzo1x algorithm from the LZO real time compression library for compression

best

Use whichever available method gives the best compression in general, though not necessarily the best for this particular output.

--help

Print the available options and exit.

--version

Print the version number and information about how SiLK was configured, then exit the application.

EXAMPLES

To convert a packet capture (pcap(3)) file, packets.dat, such as that produced by tcpdump(1), to the SiLK format, you could use the yaf tool (see http://tools.netsa.cert.org/yaf/):

  yaf --silk --in packets.dat --out - \
      | rwipfix2silk --silk-output=silk.dat

To convert the file back into an IPFIX format:

  rwsilk2ipfix --silk-output=silk2.rwf ipfix.dat

To have yaf decode VLAN identifiers for 802.1Q packets and to have rwipfix2silk store the VLAD IDs in the input and output fields of the SiLK Flow records, use:

  yaf --mac --silk --in packets.dat --out - \
      | rwipfix2silk --silk-output=silk.dat --interface-values=vlan

SEE ALSO

rwsilk2ipfix(1), rwfileinfo(1), yaf(1)