What it does
SiLK is CERT NetSA's suite for collecting, packing and querying network flow records, including filtering and statistical analysis of historical traffic.
SiLK packs IPFIX or NetFlow exports into compact files for later analysis. Start a query with the relevant sensor and time range, then use rwfilter predicates to separate matching records from the rest. Its pass, fail and all streams contain binary SiLK records, so pipe them to rwcut for a readable view or into other suite tools for statistics. rwfilter requires an output and rejects writing binary records directly to a terminal. The workflow depends on an established collection/archive configuration and reflects those sensors’ coverage. The publisher identifies GPLv2 software and several tested Unix environments; match deployment details to the installed release.
Strengths
- Collection and historical query workflow
- Composable filtering and statistical tools
Watch out for
- Requires deployment and a flow-data archive
Sources
- SiLK (Oct 26, 2026)
- SiLK record selection and binary output (Oct 26, 2026)