silk(7) SiLK Tool Suite silk(7) NAME SiLK - the System for Internet-Level Knowledge DESCRIPTION SiLK is a collection of traffic analysis tools developed by the CERT Net- work Situational Awareness Team (CERT NetSA) to facilitate security analy- sis of large networks. The SiLK tool suite supports the efficient collec- tion, storage, and analysis of network flow data, enabling network security analysts to rapidly query large historical traffic data sets. SiLK is ide- ally suited for analyzing traffic on the backbone or border of a large, distributed enterprise or mid-sized ISP. A SiLK installation consists of two categories of applications: the analy- sis suite and the packing system. Analysis Suite The SiLK analysis suite is a collection of command-line tools for process- ing SiLK Flow records created by the SiLK packing system. These tools read binary files containing SiLK Flow records and partition, sort, and count these records. The most important analysis tool is rwfilter(1), an appli- cation for querying the central data repository for SiLK Flow records that satisfy a set of filtering options. The tools are intended to be combined in various ways to perform an analysis task. A typical analysis uses UNIX pipes and intermediate data files to share data between invocations of tools. The tools, configuration files, and plug-in modules that make up the analy- sis tools are listed below, roughly grouped by functionality. Filtering, Sorting, and Display rwfilter(1) partitions SiLK Flow records into one or more 'pass' and/or 'fail' output streams. rwfilter is the primary tool for pulling flows from the data store. silk.conf(5) is the configuration file naming the Classes, Types, and Sen- sors available at your installation. rwsort(1) sorts SiLK Flow records using a user-specified key comprised of record attributes, and writes the records to the named output path or to the standard output. Users may define new key fields using plug-ins writ- ten in C or PySiLK. rwcut(1) prints the attributes of SiLK Flow records in a delimited, colum- nar, human-readable format. Users may define new printable attributes us- ing plug-ins written in C or PySiLK. SiLK Python Extension pysilk(3). PySiLK, the SiLK Python extension, allows one to read, manipu- late, and write SiLK Flow records, IPsets, and Bags from within Python. PySiLK may be used in a stand-alone Python program or to write plug-ins for several SiLK applications. This document describes the objects, methods, and functions that PySiLK provides. The next entry describes using PySiLK from within a plug-in. silkpython(3). The SiLK Python plug-in provides a way to use PySiLK to de- fine new partitioning rules for rwfilter(1), new key fields for rwcut(1), rwgroup(1), and rwsort(1), and new key or value fields for rwstats(1) and rwuniq(1). Counting, Grouping, and Mating rwuniq(1) bins (groups) SiLK Flow records by a user-specified key comprised of record attributes and prints the total byte, packet, and/or flow counts for each bin. rwuniq may also print distinct source IP and destination IP counts. Users may define new key fields and value fields using plug-ins written in C or PySiLK. rwcount(1) summarizes SiLK Flow records across time, producing textual out- put with counts of bytes, packets, and flow records for each time bin. rwstats(1) summarizes SiLK Flow records by a user-specified key comprised of record attributes, computes values from the flow records that match each key, sorts the results by the value to generate a Top-N or Bottom-N list, and prints the results. Users may define new key fields and value fields using plug-ins written in C or PySiLK. rwtotal(1) summarizes SiLK Flow records by a specified key and prints the sum of the byte, packet, and flow counts for flows matching the key. rwaddrcount(1) summarizes SiLK flow records by the source or destination IP and prints the byte, packet, and flow counts for each IP. rwgroup(1) groups SiLK flow records by a user-specified key comprised of record attributes, labels the records with a group ID that is stored in the next-hop IP field, and writes the resulting flows to the specified output path or to the standard output. rwgroup requires that its input is sorted. rwmatch(1) matches (mates) records as queries and responses and marks mated records with an ID that is stored in the next-hop IP field. rwmatch re- quires that its input is sorted. IPsets, Bags, Aggregate Bags, and Prefix Maps An IPset is a data structure and a binary file format that contains a list of IP addresses where each IP appears once (a mathematical set). A Bag is a data structure and a binary file format where a key is mapped to a counter (similar to a hash table or Python dictionary). The key is ei- ther a 32-bit number or an IPv6 address, and the counter is a 64-bit num- ber. Usually the key represents an aspect of a flow record (an IP address, a port number, the protocol) and the counter is a volume (the number of flow records, the sum of the packet counts) for the flow records that match that key. An Aggregate Bag is similar to a Bag except the key and/or the counter may be comprised of multiple fields. Aggregate Bags were introduced in SiLK 3.15.0. A prefix map is a data structure and file format that maps every IP address to string. An example prefix map gives the two-letter country code for any IP address. rwset(1) reads SiLK Flow records and generates binary IPset file(s) con- taining the source IP addresses or destination IP addresses seen on the flow records. rwsetbuild(1) reads (textual) IP addresses in dotted-quad or CIDR notation from an input file or from the standard input and writes a binary IPset file. rwsetcat(1) prints the contents of a binary IPset file as text. Additional information about the IPset file may be printed. rwsettool(1) performs union, intersection, difference, and sampling func- tions on the input IPset files, generating a new IPset file. rwsetmember(1) determines whether the IP address specified on the command line is contained in an IPset. rwbag(1) reads SiLK Flow records and builds binary Bag(s) containing key-count pairs. An example is a Bag containing the sum of the byte counts for each source port seen on the flow records. rwbagbuild(1) creates a binary Bag file from a binary IPset file or from a textual input file. rwbagcat(1) prints binary Bag files as text. rwbagtool(1) performs operations (e.g., addition, subtraction) on binary Bag files and produces a new Bag file. rwaggbag(1) reads SiLK Flow records and builds a binary Aggregate Bag con- taining key-count pairs. An example is a Aggregate Bag containing the sum of the byte counts for each source port seen on the flow records. Since SiLK 3.15.0. rwaggbagbuild(1) creates a binary Aggregate Bag file from a textual input file. Since SiLK 3.15.0. rwaggbagcat(1) prints binary Aggregate Bag files as text. Since SiLK 3.15.0. rwaggbagtool(1) performs operations (e.g., addition, subtraction) on binary Aggregate Bag files and produces a new Aggregate Bag file. Since SiLK 3.15.0. rwpmapbuild(1) reads textual input and creates a binary prefix map file for use with the Address Type (addrtype(3)) and Prefix Map (pmapfilter(3)) utilities. rwpmapcat(1) prints information about a prefix map file as text. By de- fault, prints each IP range in the prefix map and its label. rwpmaplookup(1) finds information about specific IP address(es) or proto- col/port pair(s) in a binary prefix map file and prints the result as text. rwipaimport(1) imports a SiLK IPset, Bag, or Prefix Map file into the IP Address Association (IPA <http://tools.netsa.cert.org/ipa/>) library. rwipaexport(1) exports a set of IP addresses from the IP Address Associa- tion (IPA) library to a SiLK IPset, Bag, or Prefix Map. IP and Port Labeling Files addrtype(3). The Address Type file provides a way to map an IPv4 address to an integer denoting the IP as internal, external, or non-routable. ccfilter(3). The Country Code file provides a mapping from an IP address to two-letter, lowercase abbreviation of the country what that IP address is located. The abbreviations used by the Country Code utility are those defined by ISO 3166-1 (see for example <https://www.iso.org/iso-3166-coun- try-codes.html> or <https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2>). pmapfilter(3). Prefix map files provide a way to map field values to string labels based on a user-defined map file. The map file is created by rwpmapbuild(1). Run Time Plug-Ins To use most of these plug-ins, the plug-in must be explicitly loaded into an application by using the application's --plugin switch and giving the plug-in's library name or path as the argument. For a plug-in named NAME, the library is typically named NAME.so. app-mismatch(3). The application-mismatch plug-in helps to find services running on unusual or non-typical ports by causing rwfilter(1) to only pass a flow record when the record's application field is non-zero and its value is different than that in the source port and destination port fields. conficker-c(3). The conficker-c plug-in was written in March 2009 to detect traffic that matches the signature of the .C variant of the Conficker worm. cutmatch(3). The cutmatch plug-in creates a field in rwcut(1) that provides a more user-friendly representation of the match parameter value that rw- match(1) writes into a SiLK Flow record's next hop IP field. flowkey(3). The flowkey plug-in adds a switch and a field that computes a 32-bit hash for a flow record using the same algorithm as YAF uses for its flow key utility getFlowKeyHash(1). Since SiLK 3.15.0. flowrate(3). The flowrate plug-in adds switches and fields to compute packets/second, bytes/second, bytes/packet, payload-bytes, and pay- load-bytes/second. int-ext-fields(3). The internal/external plug-in makes available fields containing internal and external IPs and ports (int-ip, ext-ip, int-port, and ext-port). It can be used to print, sort by, or group by the internal or external IP or port, which is useful when a single flow file contains flows in multiple directions. Since SiLK 3.0.0. ipafilter(3). The IPA (IP Association) plug-in works with rwfilter to par- tition flows based on data in an IPA data store. rwfilter will automati- cally load this plug-in if it is available. The plug-in requires that SiLK be compiled with IPA support (<http://tools.netsa.cert.org/ipa/>). silk-plugin(3) describes how to create and compile a new SiLK plug-in using C. Packet and IPFIX Processing These tools operate on packet capture (pcap(3)) files, IPFIX files, or files of NetFlow v5 data. rwp2yaf2silk(1) converts a packet capture (pcap(3)) file---such as a file produced by tcpdump(1)---to a single file of SiLK Flow records. rwp2yaf2silk assumes that the yaf(1) (<http://tools.netsa.cert.org/yaf/>) and rwipfix2silk(1) commands are available on your system as it is a simple Perl wrapper around those commands. rwipfix2silk(1) converts a stream of IPFIX (Internet Protocol Flow Informa- tion eXport) records to the SiLK Flow record format. rwsilk2ipfix(1) converts a stream of SiLK Flow records to an IPFIX (Inter- net Protocol Flow Information eXport) format. rwpcut(1) reads a packet capture file and print its contents in a textual form similar to that produced by rwcut. rwpdedupe(1) detects and eliminates duplicate records from multiple packet capture input files. See also rwdedupe(1). rwpmatch(1) filters a packet capture file by writing only packets whose five-tuple and timestamp match corresponding records in a SiLK Flow file. rwptoflow(1) reads a packet capture file and generates a SiLK Flow record for every packet. rwpdu2silk(1) creates a stream of SiLK Flow records from a file containing NetFlow v5 PDU records. Scan Detection rwscan(1) attempts to detect scanning activity from SiLK Flow records. rwscan can produce files that may be loaded into a database and queried with rwscanquery. rwscanquery(1) queries the scan database which has been populated from database load files generated by rwscan. Flow File Utilities These utility applications operate on SiLK Flow files. rwcat(1) reads SiLK Flow records from the files named on the command line, or from the standard input when no files are provided, and writes the SiLK records to the specified output file or to the standard output if it is not connected to a terminal. rwappend(1) appends the SiLK Flow records contained in the second through final file name arguments to the records contained in the first file name argument. rwcombine(1) reads SiLK Flow records from files named on the command line or from the standard input. For records where the attributes field con- tains the flow timed-out flag, rwcombine attempts to find the record with the corresponding continuation flag set and combine those records into a single flow. rwcombine writes the results to the named output file or to the standard output. Since SiLK 3.9.0. rwcompare(1) determines whether two SiLK Flow files contain the same flow records. rwdedupe(1) reads SiLK Flow records from files named on the command line or from the standard input and writes the records to the named output path or to the standard output, removing any duplicate flow records. Note that rwdedupe will reorder the records as part of its processing. rwnetmask(1) reads SiLK Flow records, zeroes the least significant bits of the source-, destination-, and/or next-hop-IP address(es), and writes the resulting records to the named output path or to the standard output. rwrandomizeip(1) generates a new SiLK Flow file by substituting a pseudo-random IP address for the source and destination IP addresses in given input file. rwrecgenerator(1) generates SiLK Flow records using a pseudo-random number generator; these records may be used to test SiLK applications. Since SiLK 3.6.0. rwsplit(1) reads SiLK Flow records and generates a set of sub-files from the input. The sub-files may be limited by flow-, byte-, or packet-counts, or by unique IP count. In addition, the sub-file may contain all the flows or only a sample of them. rwswapbytes(1) generates a new SiLK Flow file by changing the byte order of the records in a given input SiLK Flow file. Utilities rwfileinfo(1) prints information (type, version, etc.) about a SiLK Flow, IPset, Bag, or Prefix Map file. rwsiteinfo(1) prints information about the sensors, classes, and types specified in the silk.conf(5) file. rwtuc(1) generates SiLK flow records from textual input; the input should be in a form similar to what rwcut(1) generates. rwfglob(1) prints to the standard output the list of files that rwfilter would normally process for a given set of file selection switches. num2dot(1) reads delimited text from the standard input, converts integer values in the specified column(s) (default first column) to dotted-decimal IP address, and prints the result to the standard output. rwgeoip2ccmap(1) reads the MaxMind GeoIP database and creates the country code mapping file that may be used by SiLK (see ccfilter(3)). rwidsquery(1) invokes rwfilter to find flow records matching Snort signa- tures. rwresolve(1) reads delimited text from the standard input, attempts to re- solve the IP addresses in the specified column(s) to host names, and prints the result to the standard output. silk_config(1) prints information about how SiLK was compiled; this infor- mation may be used to compile and link other files and programs against the SiLK header files and libraries. Deprecated Tools These tools are deprecated. Their functionality is available in other ap- plications. mapsid(1) maps between sensor names and sensor IDs using the values speci- fied in the silk.conf(5) file. mapsid is deprecated as of SiLK 3.0.0, and it will be removed in the SiLK 4.0 release. This functionality is avail- able in rwsiteinfo(1). rwguess(8) reads a file containing NetFlow v5 PDU records and prints the SNMP interfaces that are used most often and the number of records seen for each interface. rwguess is deprecated as of SiLK 3.8.3, and it will be re- moved in the SiLK 4.0 release. Similar functionality is available using a combination of rwpdu2silk(1), rwstats(1), and rwuniq(1). rwip2cc(1) maps a (textual) list of IP addresses to their country code. rwip2cc is deprecated as of SiLK 3.0.0, and it will be removed in the SiLK 4.0 release. This functionality is available in rwpmaplookup(1). Packing System The SiLK Packing System is comprised of daemon applications that collect flow records (IPFIX flows from yaf(1) or NetFlow v5 or v9 PDUs from a router), convert the records to the SiLK flow format, categorize the flows as incoming or outgoing, and write the records to their final destination in binary flat files for use by the analysis suite. Files are organized in a time-based directory hierarchy with files covering each hour at the leaves. The tools, configuration files, and plug-ins that comprise the SiLK Packing System are: flowcap(8) listens to flow generators (devices which produce network flow data) and stores the data in temporary files prior to transferring the files to a remote machine for processing by rwflowpack. rwflowpack(8) reads flow data either directly from a flow generator or from files generated by flowcap, converts the data to the SiLK flow record for- mat, categorizes the flow records according to rules loaded from a pack- ing-logic plug-in, and writes the records either to hourly flat-files orga- nized in a time-based directory structure or to files for transfer to a re- mote machine for processing by rwflowappend. rwflowappend(8) watches a directory for files containing small numbers of SiLK flow records and appends those records to hourly files organized in a time-based directory tree. rwsender(8) watches an incoming directory for files, moves the files into a processing directory, and transfers the files to one or more rwreceiver processes. Either rwsender or rwreceiver may act as the server (i.e., lis- ten for incoming network connections) with the other acting as the client. rwreceiver(8) accepts files transferred from one or more rwsender processes and stores them in a destination directory. Either rwsender or rwreceiver may act as the server with the other acting as the client. rwpollexec(8) monitors a directory for incoming files and runs a user-spec- ified command on each file. rwpackchecker(8) reads SiLK Flow records and checks for unusual patterns that may indicate data file corruption. sensor.conf(5) is a configuration file for sensors and probes used by rwflowpack and flowcap. packlogic-twoway(3) is one of the plug-ins available that describe a set of rules (the packing-logic) that rwflowpack may use when categorizing flow records as incoming or output. packlogic-generic(3) is one of the plug-ins available that describe a set of rules (the packing-logic) that rwflowpack may use when categorizing flow records as incoming or output. ENVIRONMENT The following environment variables affect the tools in the SiLK tool suite. The variables are listed alphabetically. (Additional environment variables that are specific to a tool are documented on the tool's manual page.) PAGER The applications that support paging their output use the value in this environment variable when the SILK_PAGER environment variable is not set and the application's --pager switch is not used. PYTHONPATH The Python modules and library files required to use PySiLK from rwfil- ter(1), rwcut(1), rwsort(1), and rwuniq(1) as well as from Python it- self are installed under SiLK's installation tree by default. It may be necessary to set or modify the PYTHONPATH environment variable so Python can find these files. For information on using the PySiLK mod- ule, see silkpython(3) as well as the SiLK in Python handbook. PYTHONVERBOSE If the SiLK Python extension or plug-in fails to load, setting this en- vironment variable to a non-empty string may help you debug the issue. RWRECEIVER_TLS_PASSWORD Used by rwreceiver(8), this variable specifies the password to use to decrypt the PKCS#12 file specified in the --tls-pkcs12 switch. RWSENDER_TLS_PASSWORD Used by rwsender(8), this variable specifies the password to use to de- crypt the PKCS#12 file specified in the --tls-pkcs12 switch. SILK_ADDRESS_TYPES This environment variable allows the user to specify the address types mapping file used by the fields and switches specified in the addr- type(3) manual page. The value may be a complete path or a file rela- tive to SILK_PATH. See the "FILES" section for standard locations of this file. SILK_CLOBBER The SiLK tools normally refuse to overwrite existing files. Setting SILK_CLOBBER to a non-empty value (other than 0) removes this restric- tion. SILK_COMPRESSION_METHOD For most tools that implement the --compression-method switch, this en- vironment variable is used as the value for that switch when it is not provided. Since SiLK 3.13.0. SILK_CONFIG_FILE This environment variable contains the location of the site configura- tion file, silk.conf(5). This variable has precedence over all methods of finding the site file except for the --site-config-file switch on an application. For additional locations where site configuration file may reside, see the "FILES" section. SILK_COUNTRY_CODES This environment variable allows the user to specify the country code mapping file used by the fields and switches specified in the ccfil- ter(3) manual page. The value may be a complete path or a file rela- tive to SILK_PATH. See the "FILES" section for standard locations of this file. SILK_DATA_ROOTDIR This variable gives the root of directory tree where the data store of SiLK Flow files is maintained, overriding the location that is compiled into the tools (/data). The rwfilter(1) and rwfglob(1) tools use this value when selecting which flow files to process unless the user passes the --data-rootdir switch to the application. In addition, the SiLK tools search for the site configuration file, silk.conf, in this direc- tory. SILK_ICMP_SPORT_HANDLER Modifies how "buggy" ICMP SiLK flow records are handled. ICMP type and code are normally encoded in the destination port field. Prior to SiLK 3.4.0, a bug existed when processing IPFIX bi-flow ICMP records where the type and code of the second records were stored in the source port. SiLK 3.4.0 attempts to work-around this bad encoding by modifying the buggy ICMP SiLK Flow records as they are initially read. However, the change in SiLK 3.4.0 removes a previous work-around designed to fix is- sues with SiLK Flow records collected prior to SiLK 0.8.0 that origi- nated as NetFlow v5 PDUs from some types of Cisco routers. The ICMP records from these Cisco routers encoded the type and code in the source port, but the bytes were swapped from the normal encoding. When the SILK_ICMP_SPORT_HANDLER environment variable is set to "none", all work-arounds for buggy ICMP records are disabled and the source and destination ports remain unchanged. SILK_IPSET_RECORD_VERSION For the IPset family of tools, this environment variable is used as the default value for the --record-version switch when the switch is not provided on the command line. The variable is also used by rwbag- tool(1) and rwaggbagtool(1) when writing an IPset file. Since SiLK 3.7.0. SILK_IPV6_POLICY For tools that implement the --ipv6-policy switch, this environment variable is used as the value for that switch when it is not provided. SILK_IP_FORMAT For tools that implement the --ip-format switch, this environment vari- able is used as the value for that switch when it is not provided. Since SiLK 3.11.0. SILK_LOGSTATS This environment variable is currently an alias for the SILK_LOGSTATS_RWFILTER environment variable described below. The abil- ity to log invocations may be extended to other SiLK tools in future releases. SILK_LOGSTATS_DEBUG If the environment variable is set to a non-empty value, rwfilter(1) prints messages to the standard error about the SILK_LOGSTATS value be- ing used and either the reason why the value cannot be used or the ar- guments to the external program being executed. SILK_LOGSTATS_RWFILTER When set to a non-empty value, rwfilter(1) treats the value as the path to a program to execute with information about this rwfilter invoca- tion. Its purpose is to provide the SiLK administrator with informa- tion on how the SiLK tool set is being used. SILK_PAGER When this variable is set to a non-empty string, most of the applica- tions that produce textual output (e.g., rwcut(1)) automatically invoke this program to display their output a screen at a time. If set to an empty string, no paging of the output is performed. The PAGER variable is checked when this variable is not set. The --pager switch on an ap- plication overrides this value. SILK_PATH This environment variable gives the root of the directory tree where the tools are installed. As part of its search for configuration files and plug-ins, a SiLK application may use this variable. See the "FILES" section for details. SILK_PLUGIN_DEBUG When this variable is set to a non-empty value, an application that supports plug-ins prints status messages to the standard error as it tries to locate and open each of its plug-ins. SILK_PYTHON_TRACEBACK If a Python plug-in encounters a Python-related error and this environ- ment variable is set to a non-empty value, the application prints the error's traceback information to the standard error. SILK_RWFILTER_THREADS This variable sets the number of threads rwfilter(1) uses while reading input files or files selected from the data store. SILK_TEMPFILE_DEBUG When set to 1, the library that manages temporary files for rwcom- bine(1), rwdedupe(1), rwsort(1), rwstats(1), and rwuniq(1) prints de- bugging messages to the standard error as it creates, re-opens, and re- moves temporary files. SILK_TIMESTAMP_FORMAT For tools that implement the --timestamp-format switch, this environ- ment variable is used as the value for that switch when it is not pro- vided. Since SiLK 3.11.0. SILK_TMPDIR This variable is used by tools that write temporary files (e.g., rw- sort(1)) as the directory in which to store those files. When this variable is not set, the value of the TMPDIR variable is checked. The --temp-directory switch on an application overrides this value. SILK_UNIQUE_DEBUG When set to 1, the binning engine used by rwstats(1) and rwuniq(1) prints debugging messages to the standard error. TMPDIR When this variable is set and SILK_TMPDIR is not set, temporary files are created in this directory. The value given to an application's --temp-directory switch takes precedence over both variables. TZ When a SiLK installation is built to use the local timezone (to deter- mine if this is the case, check the "Timezone support" value in the output from the --version switch on most SiLK applications), the value of the TZ environment variable determines the timezone in which time- stamps are displayed and parsed. If the TZ environment variable is not set, the default timezone is used. Setting TZ to 0 or to the empty string causes timestamps to be displayed in and parsed as UTC. The value of the TZ environment variable is ignored when the SiLK installa- tion uses UTC unless the user requests use of the local timezone via a tool's --timestamp-format switch. For system information on the TZ variable, see tzset(3) or environ(7). FILES The following file and directory locations are used by SiLK tools. A dol- lar sign preceding a name enclosed in braces (e.g., "${SILK_PATH}"), refers to the value of the named environment variable. ${SILK_ADDRESS_TYPES} ${SILK_PATH}/share/silk/address_types.pmap ${SILK_PATH}/share/address_types.pmap /usr/local/share/silk/address_types.pmap /usr/local/share/address_types.pmap Locations that applications check when searching for the address types mapping file used by addrtype(3), rwpmapcat(1), and rwpmaplookup(1). ${SILK_CONFIG_FILE} ROOT_DIRECTORY/silk.conf ${SILK_PATH}/share/silk/silk.conf ${SILK_PATH}/share/silk.conf /usr/local/share/silk/silk.conf /usr/local/share/silk.conf Possible locations for the SiLK site configuration file which are checked when the --site-config-file switch is not provided. The value of ROOT_DIRECTORY/ is the root directory of the SiLK repository; that directory may be specified by a command line switch (e.g., the --data-rootdir switch on rwfilter(1)), by the SILK_DATA_ROOTDIR envi- ronment variable, or by the default location compiled into the SiLK tools (/data). ${SILK_COUNTRY_CODES} ${SILK_PATH}/share/silk/country_codes.pmap ${SILK_PATH}/share/country_codes.pmap /usr/local/share/silk/country_codes.pmap /usr/local/share/country_codes.pmap Locations that applications check when searching for the country code mapping file used by ccfilter(3), rwbag(1), rwpmapcat(1), rw- pmaplookup(1), and other SiLK tools. ${SILK_DATA_ROOTDIR}/ /data/ Locations for the root directory of the data repository. Some applica- tions provide a command line switch to specify this value (for example, the --data-rootdir switch on rwfilter(1), rwfglob(1), and rwsite- info(1)). ${SILK_PATH}/lib64/silk/ ${SILK_PATH}/lib64/ ${SILK_PATH}/lib/silk/ ${SILK_PATH}/lib/ /usr/local/lib64/silk/ /usr/local/lib64/ /usr/local/lib/silk/ /usr/local/lib/ Directories that a SiLK application checks when attempting to load a plug-in. ${SILK_TMPDIR}/ ${TMPDIR}/ /tmp/ Directory in which to create temporary files when a directory was not specified using the application's --temp-directory switch. SEE ALSO Analysts' Handbook: Using SiLK for Network Traffic Analysis, The SiLK Ref- erence Guide, SiLK Installation Handbook, <http://tools.netsa.cert.org/silk/> SiLK 3.22.2 2026-08-27 silk(7)
NAME | DESCRIPTION | ENVIRONMENT | FILES | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=silk&sektion=7&manpath=FreeBSD+Ports+15.1.quarterly>