System for Internet-Level Knowledge System for Internet-Level Knowledge (SiLK) project is a collection of traffic analysis tools.
Download

System for Internet-Level Knowledge Ranking & Summary

System for Internet-Level Knowledge Tags

knowledge traffic Internet-Level Knowledge traffic analysis traffic logging Internet-Level

System for Internet-Level Knowledge Description

System for Internet-Level Knowledge (SiLK) project is a collection of traffic analysis tools. System for Internet-Level Knowledge (SiLK) project is a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.The SiLK tool suite supports the efficient collection, storage and analysis of network flow data, enabling network security analysts to rapidly query large historical traffic data sets. SiLK is ideally suited for analyzing traffic on the backbone or border of a large, distributed enterprise or mid-sized ISP.SiLK consists of two sets of tools: a packing system and analysis suite. The packing system receives Netflow V5 PDU's and converts them into a more space efficient format, recording the packed records into service-specific binary flat files. The analysis suite consists of tools which can read these flat files and then perform various query operations, ranging from per-record filtering to statistical analysis of groups of records. The analysis tools interoperate using pipes, allowing a user to develop a relatively sophisticated query from a simple beginning.The vast majority of the current code-base is implemented in C, Perl, or Python. This code has been tested on Linux, Solaris, OpenBSD, and Mac OS X, but should be usable with little or no change on other Unix platforms.System for Internet-Level Knowledge software components are released under the GPL.What's New in This Release:· It is now possible to use the PySiLK (SiLK in Python) capability in rwcut, rwuniq, and rwsort to create arbitrary fields for printing, counting, and sorting.· rwuniq can count more bins than will fit in memory.· When its hash table fills, rwuniq uses temporary files to store the data and merges these files once all input has been read.· rwtotal has minimum and maximum thresholds.· rwflowpack and the sensor.conf syntax have been changed to allow the administrator to explicitly set the directionality of collected flows (for use on a unidirectional tap).

System for Internet-Level Knowledge Related Software