How many bytes does a single SiLK Flow record occupy on disk?
A fully-expanded, uncompressed, SiLK Flow record requires 52 bytes (this is 88 bytes for IPv6 records). These records are written by rwcat –compression=none. Records in the SiLK data repository require less space since common attributes (sensor, class, type, hour) are stored once in the file’s header. The smallest record (uncompressed) in the data repository is that representing a web flow which requires only 22 bytes. In addition, one can enable data compression in an individual SiLK application (with the –compression-method switch) or in all SiLK applications when SiLK is configured (specify the –enable-output-compression switch when you invoke the configure script). Compression with the lzo1x algorithm reduces the overall file size by about 50%. Using zlib gives a better compression ratio, but the at the cost of access time. The rwfileinfo command will tell you the (uncompressed) size of records in a SiLK file.
