Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
rwpdu2silk(1)			SiLK Tool Suite			 rwpdu2silk(1)

       rwpdu2silk - Convert NetFlow v5 records to SiLK Flow records

	 rwpdu2silk [--silk-output=PATH] [--print-statistics]
	       [--log-destination={stdout | stderr | none | PATH}]
	       [--log-flags={none | { {all | bad | default | missing
				       | record-timestamps} ...} } ]
	       [--note-add=TEXT] [--note-file-add=FILE]
	       {--xargs	| --xargs=FILENAME | PDUFILE [PDUFILE...]}

	 rwpdu2silk --help

	 rwpdu2silk --version

       rwpdu2silk reads	NetFlow	v5 PDU (Protocol Data Units) records from one
       or more files, converts the records to the SiLK Flow format, and	writes
       the SiLK	records	to the path specified by --silk-output or to the
       standard	output when --silk-output is not provided.  Note that
       rwpdu2silk cannot read from the standard	input.

       rwpdu2silk expects its input files to be	a the format created by
       Cisco's NetFlow Collector: The file's size must be an integer multiple
       of 1464,	where each 1464	octet chunk contains a 24 octet	NetFlow	v5
       header and space	for thirty 48 octet NetFlow v5 records.	 The number of
       valid records per chunk is specified in the header.

       rwpdu2silk reads	NetFlow	v5 records from	the files named	on the command
       line when --xargs is not	present.  If an	input file name	ends in	".gz",
       the file	is uncompressed	as it is read.	When the --xargs switch	is
       provided, rwpdu2silk reads the names of the files to process from the
       named text file or from the standard input if no	file name argument is
       provided	to the switch.	The input to --xargs must contain one file
       name per	line.

       Option names may	be abbreviated if the abbreviation is unique or	is an
       exact match for an option.  A parameter to an option may	be specified
       as --arg=param or --arg param, though the first form is required	for
       options that take optional parameters.

	   Write the binary SiLK Flow records to PATH, where PATH is a
	   filename, a named pipe, the keyword "stderr"	to write the output to
	   the standard	error, or the keyword "stdout" or "-" to write the
	   output to the standard output.  If PATH names an existing file,
	   rwpdu2silk exits with an error unless the SILK_CLOBBER environment
	   variable is set, in which case PATH is overwritten.	If this	switch
	   is not given, the output is written to the standard output.
	   Attempting to write the binary output to a terminal causes
	   rwpdu2silk to exit with an error.

	   Print, to the standard error, the number of records that were
	   written to the SiLK output file.  See also --log-destination.

       --log-destination={none | stdout	| stderr | PATH}
	   Write more detailed information to the specified destination.  The
	   default destination is none which suppresses	messages.  Use stdout
	   or stderr to	send messages to the standard output or	standard
	   error, respectively.	 Any other value is treated as a file name in
	   which to write the messages.	 When an existing file is specified,
	   rwpdu2silk appends any messages to the file.	 Information that is
	   written includes the	following:

	   o   For each	input stream, the number of PDU	records	read, number
	       of SiLK records generated, number of missing records (based on
	       the NetFlow v5 sequence number),	and number of invalid records.

	   o   Messages	about each NetFlow v5 packet that was rejected due a
	       bad version number or having a record count of 0	or more	than

	   o   Additional messages enabled by the --log-flags switch.

	   Write additional messages regarding the NetFlow v5 data to the
	   --log-destination, where FLAGS is a comma-separated list of names
	   specifying the type messages	to write.  When	this switch is not
	   specified, the default value	for FLAGS is "none".  This switch
	   takes the same values as the	log-flags setting in the
	   sensor.conf(5) file.	 This manual page documents the	values that
	   are relevant	for NetFlow v5 data.  Since SiLK 3.10.0.

	   all Log everything.

	   bad Write messages about an individual NetFlow v5 record where the
	       packet or octet count is	zero, the packet count is larger than
	       the octet count,	or the duration	of the flow is larger than 45

	       Enable the default set of log-flags used	by sensor.conf:	bad,
	       missing.	 Despite the name, this	is not the default setting for
	       this switch; none is.

	       Examine the sequence numbers of NetFlow v5 packets and write
	       messages	about missing and out-of-sequence packets.

	       Log nothing.  It	is an error to combine this log-flag name with
	       any other.  This	is the default setting for --log-flags.

	       Log the timestamps that appear on each record.  This produces a
	       lot of output, and it is	primarily used for debugging.

	   Add the specified TEXT to the header	of the output file as an
	   annotation.	This switch may	be repeated to add multiple
	   annotations to a file.  To view the annotations, use	the
	   rwfileinfo(1) tool.

	   Open	FILENAME and add the contents of that file to the header of
	   the output file as an annotation.	This switch may	be repeated to
	   add multiple	annotations.  Currently	the application	makes no
	   effort to ensure that FILENAME contains text; be careful that you
	   do not attempt to add a SiLK	data file as an	annotation.

	   Specify the compression library to use when writing output files.
	   If this switch is not given,	the value in the
	   SILK_COMPRESSION_METHOD environment variable	is used	if the value
	   names an available compression method.  When	no compression method
	   is specified, output	to the standard	output or to named pipes is
	   not compressed, and output to files is compressed using the default
	   chosen when SiLK was	compiled.  The valid values for	COMP_METHOD
	   are determined by which external libraries were found when SiLK was
	   compiled.  To see the available compression methods and the default
	   method, use the --help or --version switch.	SiLK can support the
	   following COMP_METHOD values	when the required libraries are

	       Do not compress the output using	an external library.

	       Use the zlib(3) library for compressing the output, and always
	       compress	the output regardless of the destination.  Using zlib
	       produces	the smallest output files at the cost of speed.

	       Use the lzo1x algorithm from the	LZO real time compression
	       library for compression,	and always compress the	output
	       regardless of the destination.  This compression	provides good
	       compression with	less memory and	CPU overhead.

	       Use the snappy library for compression, and always compress the
	       output regardless of the	destination.  This compression
	       provides	good compression with less memory and CPU overhead.
	       Since SiLK 3.13.0.

	       Use lzo1x if available, otherwise use snappy if available,
	       otherwise use zlib if available.	 Only compress the output when
	       writing to a file.

	   Read	the names of the input files from FILENAME or from the
	   standard input if FILENAME is not provided.	The input is expected
	   to have one filename	per line.  rwpdu2silk opens each named file in
	   turn	and reads records from it as if	the filenames had been listed
	   on the command line.

	   Print the available options and exit.

	   Print the version number and	information about how SiLK was
	   configured, then exit the application.

	   The SiLK tools normally refuse to overwrite existing	files.
	   Setting SILK_CLOBBER	to a non-empty value removes this restriction.

	   This	environment variable is	used as	the value for
	   --compression-method	when that switch is not	provided.  Since SiLK

       rwfileinfo(1), rwflowpack(8), sensor.conf(5), silk(7), zlib(3)

       rwpdu2silk cannot read from the standard	input.

SiLK 3.19.1			  2020-08-27			 rwpdu2silk(1)


Want to link to this manual page? Use this URL:

home | help