Where is the SiLK Flow file format documented?
SiLK uses many different file formats. There are file formats for IPsets, for Bags, and for Prefix Maps; in addition, there several file formats for SiLK Flow records. These file formats are used to provide maximum compression the data in the SiLK Flow repository. The rwcat tool can be used on any SiLK Flow file(s) to write the Flows into a known format. The rwcat command to use is: rwcat –compression=none –byte-order=big [–ipv4-output] FILE1 FILE2 … That command will produce an output stream/file having a standard SiLK header followed by 0 or more records in the format given in the following table. The length of the SiLK header is the same as the size of the records in the file. When SiLK is not compiled with IPv6 support or the –ipv4-output switch is given, each record will be 52 bytes long, and the header is 52 bytes; otherwise each record is 88 bytes and the file’s header is 88 bytes. The other SiLK Flow file formats are only documented in the comments of the source files. Se
