How do I convert packet data (pcap) to flows?
There are four ways to handle pcap files: • Use the yaf program (from the YAF suite) to convert the pcap data to the IPFIX format, and use the rwipfix2silk program from SiLK to convert from IPFIX to a stream of SiLK Flow records. For maximum compatibility, you should pass the –silk switch to yaf. SiLK provides the rwp2yaf2silk Perl script to make this task easier. The rwipfix2silk program is only available when SiLK has been configured with libfixbuf support; see the Installation Handbook for details. • Use the yaf program to convert the pcap data to the IPFIX format, and send that data over the network to rwflowpack, which will convert from IPFIX to a repository of SiLK Flow data. This also requires that SiLK be configured with libfixbuf support. • Use the rwptoflow program, included with SiLK, to convert each packet to a SiLK Flow. Note that this tool does not combine packets into a flow, it simply converts each pcap record into a 1-packet SiLK Flow record. • Search the web for soft
