|
SiLK, the System for Internet-Level Knowledge, is a collection of
traffic analysis tools developed by the CERT Network Situational
Awareness Team (CERT NetSA) to facilitate security analysis of large
networks. The SiLK tool suite supports the efficient collection,
storage, and analysis of network flow data, enabling network security
analysts to rapidly query large historical traffic data sets. SiLK is
ideally suited for analyzing traffic on the backbone or border of a
large, distributed enterprise or mid-sized ISP.
A SiLK installation consists of two categories of applications: the
packing system and the analysis suite. The packing system collects
IPFIX, NetFlow v9, or NetFlow v5 and converts the data into a more
space efficient format, recording the packed records into
service-specific binary flat files. The analysis suite consists of
tools which read these flat files and perform various query
operations, ranging from per-record filtering to statistical analysis
of groups of records. The analysis tools interoperate using pipes,
allowing a user to develop a relatively sophisticated query from a
simple beginning.
Signed-off-by: Adam Vandenberg <flangy@gmail.com>
|
