NAME

rwipfix2silk - Convert IPFIX records to SiLK Flow records

SYNOPSIS

  rwipfix2silk [--silk-output=FILE] [--print-statistics]
        [--compression-method=COMP_METHOD] [IPFIX_FILES...]

DESCRIPTION

rwipfix2silk reads IPFIX (Internet Protocol Flow Information eXport) records from the input files specified on the command line or from the standard input when no files are specified, converts the records to the SiLK Flow format, and writes the SiLK records to the path specified by --silk-output or to the standard output when stdout is not the terminal and --silk-output is not provided.

When stdin is provided as an input file name, rwipfix2silk will read records from the standard input.

OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--silk-output=FILE

Write the SiLK records to FILE, which must not exist. If the switch is not provided or if FILE has the value stdout, the SiLK flows are written to the standard output.

--print-statistics

Print, to the standard error, the number of records that were written to the SiLK output file, and the number of forward and reverse records that were seen.

--compression-method=COMP_METHOD

Set the compression method of the output to COMP_METHOD. Some SiLK tools can use an external library to compress their binary output. The list of available compression methods and the default method are set when SiLK is compiled (the --help and --version switches print the available and default compression methods) and depend on which supported libraries are found. SiLK can support:

none

Do not compress the output using an external library

zlib

Use the zlib(3) library for compressing the output

lzo1x

Use the lzo1x algorithm from the LZO real time compression library for compression

best

Use whichever available method gives the best compression in general, though not necessarily the best for this particular output.

EXAMPLES

To convert a packet capture (pcap(3)) file, packets.dat, such as that produced by tcpdump(1), to the SiLK format, you could use the yaf tool (see http://tools.netsa.cert.org/yaf/):

  yaf --silk --in packets.dat --out - \
      | rwipfix2silk --silk-output=silk.dat

To convert the file back into an IPFIX format:

  rwsilk2ipfix --silk-output=silk2.rwf ipfix.dat

SEE ALSO

rwsilk2ipfix(1), yaf(1)