FreeBSD Manual Pages
YAF(1) Yet Another Flowmeter YAF(1) NAME yaf - Yet Another Flowmeter SYNOPSIS yaf [--in INPUT_SPECIFIER] [--out OUTPUT_SPECIFIER] [--config CONFIG_FILE] [--live LIVE_TYPE] [--ipfix TRANSPORT_PROTOCOL] [--no-output] [--decompress DECOMPRESS_DIR] [--filter BPF_FILTER] [--filter-file BPF_FILTER_FILE] [--rotate ROTATE_DELAY] [--lock] [--caplist] [--group SPREAD_GROUP_NAME(s)] [--groupby GROUPBY_TYPE] [--stats INTERVAL][--no-stats] [--noerror] [--no-tombstone] [--tombstone-configured-id IDENTIFIER] [--export-interface] [--gre-decode] [--no-frag] [--vxlan-decode] [--vxlan-decode-ports PORTS] [--geneve-decode] [--geneve-decode-ports PORTS] [--max-frags FRAG_TABLE_MAX] [--ip4-only] [--ip6-only] [--idle-timeout IDLE_TIMEOUT] [--active-timeout ACTIVE_TIMEOUT] [--udp-temp-timeout TEMPLATE_TIMEOUT] [--no-vlan-in-key] [--force-read-all] [--flow-stats] [--delta] [--ingress INGRESS_INT] [--egress EGRESS_INT] [--metadata-export] [--time-elements VALUE[,VALUE...]] [--max-payload PAYLOAD_OCTETS] [--protocol-payload PROTOCOL[,PROTOCOL...]] [--udp-payload] [--max-export PAYLOAD_OCTETS] [--max-flows FLOW_TABLE_MAX] [--export-payload] [--payload-applabel-select LABELS] [--silk] [--udp-uniflow PORT] [--uniflow] [--mac] [--force-ip6-export] [--observation-domain DOMAIN_ID] [--entropy] [--applabel] [--applabel-rules RULES_FILE] [--applabel-check-early APP_PAY_CHECK_EARLY] [--applabel-max-payload APP=OCTETS[,APP=OCTETS...]] [--ndpi] [--ndpi-protocol-file FILE] [--ipfix-port PORT] [--tls] [--tls-ca CA_PEM_FILE] [--tls-cert CERT_PEM_FILE] [--tls-key KEY_PEM_FILE] [--become-user UNPRIVILEGED_USER] [--become-group UNPRIVILEGED_GROUP] [--log LOG_SPECIFIER] [--loglevel LOG_LEVEL] [--verbose] [--version] [--p0fprint] [--p0f-fingerprints FILENAME] [--fpexport] [--plugin-name LIBPLUGIN_NAME[,LIBPLUGIN_NAME...]] [--plugin-opts "OPTIONS[,OPTIONS...]"] [--plugin-conf CONF_FILE_PATH[,CONF_FILE_PATH...]] [--pcap PCAP_EXPORT_PATH] [--pcap-per-flow] [--max-pcap MAX_FILE_MB] [--pcap-timer PCAP_ROTATE_DELAY] [--pcap-meta-file META_FILE_PREFIX [--index-pcap]] [--hash FLOW_KEY_HASH [--stime FLOW_START_TIMEMS]] DESCRIPTION yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow meter- ing. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), pf_ring, an Endace DAG capture device, a Napatech adapter, or Netronome NFE card, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Since yaf is designed to be deployed on white-box sensors attached to local network segments or span ports at symmetric routing points, it supports bidirectional flow assembly natively. Biflow export is done via the export method specified in RFC 5103 Bidirectional Flow Export using IPFIX. See the OUTPUT section below for information on this format. yaf also supports experimental partial payload capture, specifically for banner-grabbing applications and protocol verification purposes. The output of yaf is designed to be collected and manipulated by flow pro- cessing toolchains supporting IPFIX. The yafscii(1) tool, which is in- stalled as part of yaf, can also be used to print yaf output in a hu- man-readable format somewhat reminiscent of tcpdump(1). yaf output can also be analyzed using the SiLK suite, and the nafalize(1) tool, both available from the CERT NetSA group. OPTIONS Configuration File When invoking yaf, its settings may be specified in a configuration file instead of or in addition to command line arguments. --config CONFIGURATION_FILE If present, use the variables set in the CONFIGURATION_FILE. The CON- FIGURATION_FILE is a Lua configuration file, a plain text file that can also be a Lua <https://www.lua.org/> program. A sample configuration file can be found in /usr/local/share/yaf/yaf.init. yaf will use the variables set in the configuration file along with any command line ar- guments. Input Options These options control where yaf will take its input from. yaf can read packets from a pcap dumpfile (as generated by tcpdump -w) or live from an interface via libpcap, libdag, or libnapatech, or Netronome API. By de- fault, if no input options are given, yaf reads a pcap dumpfile on standard input. --in INPUT_SPECIFIER INPUT_SPECIFIER is an input specifier. If --live is given, this is the name of an interface (e.g. "eth0", "en0", "dag0", "nt3g", "nt3g0:1", "0:0") to capture packets from. Otherwise, it is a filename; the string - may be used to read from standard input (the default). See --live for more information on formats for Napatech, Dag, and Netronome Interface formats. --caplist If present, treat the filename in INPUT_SPECIFIER as an ordered, new- line-delimited list of pathnames to pcap(3) dumpfiles. These dumpfiles are processed in order using the same flow table, so they must be listed in ascending time order. If an error is encountered within a dumpfile, yaf exits immediately unless --noerror is used. This option is intended to ease the use of yaf with rotated or otherwise split tcp- dump(1) output. Within the file list, lines beginning with the charac- ter '#' and blank lines are ignored, but other whitespace is signifi- cant and is not ignored. All pathnames are evaluated with respect to yaf's working directory. Pathnames that do not exist or that cannot be opened as dumpfiles are ignored; however, if none of the entries in the file can be opened as a dumpfile, yaf exits with an error. --noerror If present, an error reading a pcap(3) record generates a warning mes- sage but does not affect the exit status of yaf. When this option is not used, yaf exits abnormally when it encounters an error reading a pcap record. This option is particularly useful with the --caplist op- tion, as it prevents yaf from exiting when processing a list of dump- files due to an error in a file: yaf warns about the error and begins to process the next pathname specified in the INPUT_SPECIFIER. --live LIVE_TYPE If present, capture packets from an interface named in the INPUT_SPECI- FIER. LIVE_TYPE is one of pcap for packet capture via libpcap, pfring for packet capture via libpfring, or dag for packet capture via an En- dace DAG interface using libdag, or napatech for packet capture via a Napatech Adapter, or netronome for packet capture via a Netronome NFE card, or zc for packet capture via PF_RING ZC. <pfring> is only avail- able if yaf was built with PF_RING support. See the yafzcbalance(1) man page for using yaf with PF_RING ZC. dag is only available if yaf was built with Endace DAG support. napatech is only available if yaf was built with Napatech API support. If LIVE_TYPE is napatech, the IN- PUT_SPECIFIER given to --in should be in the form nt3g[<streamID>:<ports>]. StreamID and Ports are optional. StreamID if given, is the ID that the traffic stream will be assigned to on the in- coming ports. Ports may be a comma-separated list of ports to listen on. If [ports] is not specified, the default is to listen on All ports. StreamID defaults to 0. netronome is only available if yaf was built with Netronome API support. If LIVE_TYPE is netronome, the IN- PUT_SPECIFIER given to --in should be in the form <device>:<ring> where device is the NFE card ID, typically 0. Ring is the capture ring ID which is configured via a modprobe configuration file and resides in /etc/modprobe.d/pcd.conf. --export-interface If present, the interface on which a packet was received will be noted internally within yaf. When flow records are exported from yaf, an "ingressInterface" and an "egressInterface" set of fields will be added to the output. The "ingressInterface" field will be the physical in- terface which captured the packet while the "egressInterface" will be the physical interface | 0x100. This can be used to separate traffic based on DAG physical ports. For use with the DAG card, traffic re- ceived on separate ports will be separated into different flows if yaf is configured with the --enable-daginterface option. Otherwise the physical port will simply be exported in the "ingressInterface" or "egressInterface" fields in the IPFIX record (flows can exist over mul- tiple interfaces). This option requires building DAG, Netronome, or Napatech support in yaf with the --with-dag, --with-napatech, or --with-netronome switch. In previous versions of yaf this option was enabled using the --dag-interface or --napatech-interface switch. It is now enabled by default when yaf is built with DAG, Netronome, or Na- patech support. It can be disabled by configuring yaf with <--en- able-interface=no>. To separate traffic received on separate ports into separate flows, you must use --enable-daginterface when configur- ing yaf. --filter BPF_FILTER If present, enable Berkeley Packet Filtering (BPF) in yaf with BPF_FIL- TER as the incoming traffic filter. Syntax of BPF_FILTER follows the expression format described in the tcpdump(1) man page. This option is not currently supported if --live is set to dag or napatech or netronome as BPF filtering is implemented with libpcap. However, you may be able to use a BPF filter by running yaf with the DAG, Napatech, or Netronome implementations of libpcap. --filter-file BPF_FILTER_FILE Set the incoming traffic filter (see --filter) from the contents of the file named BPF_FILTER_FILE. Any argument to --filter is ignored. Since yaf-2.19.0. --decompress DECOMPRESS_DIR If present and the input file(s) are compressed (gzip(1)), decompress the file to a temporary file within DECOMPRESS_DIR. If --caplist is also present, all files will be decompressed to DECOMPRESS_DIR. If this option is not present, yaf will decompress files to the variable specified by the TMPDIR environment variable or /tmp if TMPDIR is not set. The zlib library must be installed to use this feature. Output Options These options control where yaf will send its output. yaf can write flows to an IPFIX file or export flows to an IPFIX collector over SCTP, TCP, UDP, or Spread. By default, if no output options are given, yaf writes an IPFIX file to standard output. --out OUTPUT_SPECIFIER OUTPUT_SPECIFIER is an output specifier. If no other output options are given, yaf treats OUTPUT_SPECIFIER as a filename in which the flows are written unless the specifier is ""-"", in which case flows are written to the standard output. If --ipfix is present (and not set to spread), the OUTPUT_SPECIFIER specifies the hostname or IP address of the collector to which the flows will be exported. Use --ipfix-port to change the port from the default of 4739. If --ipfix is present and set to spread, OUTPUT_SPECIFIER is the name of the Spread daemon to connect to (See below examples of spread daemon names). See also the --group and --groupby options. If --rotate is present, OUTPUT_SPECIFIER is a prefix name (directory and file prefix) of each output file to write to. yaf writes the out- put to multiple files named "OUTPUT_SPECIFIER-DATETIME-SEQNUM.yaf", where DATETIME is a date-time stamp and SEQNUM is a five digit sequence number. Examples: Output to a single file "--out flows.yaf" Output to a collector on port 18000 at IP address 1.2.3.4 "--out 1.2.3.4 --ipfix-port 18000 --ipfix tcp" Output to a collector on port 4739 at host.example.com "--out host.example.com --ipfix tcp" Connect to the Spread daemon named "4803" on the local machine "--out 4803 --ipfix spread" or "--out 4803@localhost --ipfix spread" Output to multiple files in the /var/yaf/ directory rotating every two minutes "--out /var/yaf/flows --rotate 120 --lock" --ipfix TRANSPORT_PROTOCOL If present, causes yaf to operate as an IPFIX exporter, sending IPFIX Messages via the specified transport protocol to the collector (e.g., super_mediator(1) or SiLK's rwflowpack(8) or flowcap(8) facilities) named in the OUTPUT_SPECIFIER. Valid TRANSPORT_PROTOCOL values are tcp, udp, sctp, and spread; sctp is only available if yaf was built with SCTP support; spread is only available if yaf was built with Spread support. UDP is not recommended, as it is not a reliable trans- port protocol, and cannot guarantee delivery of messages. As per the recommendations in RFC 5101, yaf will retransmit templates three times within the template timeout period (configurable using --udp-temp-time- out or by default, 10 minutes). Use the --ipfix-port, --tls, --tls-ca, --tls-cert, --tls-key, and --group options to further configure the connection to the IPFIX collector. --rotate ROTATE_DELAY If present, causes yaf to write output to multiple files, opening a new output file every ROTATE_DELAY seconds in the input data. Rotated files are named using the prefix given in the OUTPUT_SPECIFIER, followed by a suffix containing a timestamp in YYYYMMDDhhmmss format, a decimal ser- ial number, and the file extension .yaf. --lock Use lockfiles for concurrent file access protection on output files. Lock files are written to the same directory as the output file, and the filename is the output filename (including any extensions) with ".lock" appended. This is recommended for interoperating with su- per_mediator(1) and the filedaemon(1) facility. --stats INTERVAL If present, causes yaf to export process statistics every INTERVAL sec- onds. The default value for INTERVAL is 300 seconds or every 5 min- utes. yaf uses IPFIX Options Templates and Records to export flow, fragment, and decoding statistics. If INTERVAL is set to zero, stats will not be exported. --no-stats If present, yaf will not export process statistics. yaf uses IPFIX Op- tions Templates and Records to export flow, fragment, and decoding sta- tistics. --no-stats takes precedence over --stats. --no-tombstone If present, yaf will not export tombstone records. yaf uses IPFIX Op- tions Templates and Records to export tombstone records. Tombstone records will only be exported if stats exporting is also active. --tombstone-configured-id IDENTIFIER If present, overrides the default "exporterConfiguredId" value in tomb- stone records. This value should be less than 0xFFFF (65535). The de- fault value is 0. --no-output If present, yaf will not export IPFIX data. It will ignore any argu- ment provided to --out. Decoder Options These options are used to modify the yaf packet decoder's behavior. None of these options are required; the default behavior for each option when not present is noted. --no-frag If present, ignore all fragmented packets. By default, yaf will re- assemble fragments with a 30 second fragment timeout. --max-frags FRAG_TABLE_MAX If present, limit the number of outstanding, not-yet reassembled frag- ments in the fragment table to FRAG_TABLE_MAX by prematurely expiring fragments from the table. This option is provided to limit yaf resource usage when operating on data from very large networks or networks with abnormal fragmentation. The fragment table may exceed this limit slightly due to limits on how often yaf prunes the fragment table (every 5 seconds). By default, there is no fragment table limit, and the fragment table can grow to resource exhaustion. --ip4-only If present, ignore all IPv6 packets and export IPv4 flows only. The default is to process both IPv4 and IPv6 packets. --ip6-only If present, ignore all IPv4 packets and export IPv6 flows only. The default is to process both IPv4 and IPv6 packets. --gre-decode If present, attempt to decode GRE version 0 encapsulated packets. Flows will be created from packets within the GRE tunnels. Undecodable GRE packets will be dropped. Without this option, GRE traffic is exported as IP protocol 47 flows. This option is presently experimental. --vxlan-decode If present, attempt to decode UDP-VxLAN encapsulated packets over spec- ified ports. The default port is 4789. Flows will be created from packets within the VxLAN tunnels. Undecodable VxLAN packets will be dropped. Exports the VNI to yafLayer2SegmentId. VxLAN VNI exporting takes precedence over Geneve VNI exporting when Geneve is also enabled. Since yaf-2.15.0. --vxlan-decode-ports PORTS_LIST If VxLAN decoding is enabled, only attempt to decode UDP-VxLAN encapsu- lated packets if the packet's destination port is specified in PORTS_LIST, a comma separated list of ports (integers from 0 to 65535 inclusive). This option is ignored when --vxlan-decode is not speci- fied. Since yaf-2.15.0. --geneve-decode If present, attempt to decode Geneve encapsulated packets over speci- fied ports. The default port is 6081. Flows will be created from pack- ets within the Geneve tunnels. Undecodable Geneve packets will be dropped. Exports the VNI to yafLayer2SegmentId unless VxLAN decoding is also enabled. Since yaf-2.15.0. --geneve-decode-ports PORTS_LIST If Geneve decoding is enabled, only attempt to decode Geneve encapsu- lated packets if the packet's destination port is specified in PORTS_LIST, a comma separated list of ports (integers from 0 to 65535 inclusive). This option is ignored when --geneve-decode is not speci- fied. Since yaf-2.15.0. Flow Table Options These options are used to modify the flow table behavior within yaf. None of these options are required; the default behavior for each option when not present is noted. --idle-timeout IDLE_TIMEOUT Set flow idle timeout in seconds. Flows are considered idle and flushed from the flow table if no packets are received for IDLE_TIMEOUT sec- onds. The default flow idle timeout is 300 seconds (5 minutes). Set- ting IDLE_TIMEOUT to 0 creates a flow for each packet. --active-timeout ACTIVE_TIMEOUT Set flow active timeout in seconds. Any flow lasting longer than AC- TIVE_TIMEOUT seconds will be flushed from the flow table. The default flow active timeout is 1800 seconds (30 minutes). --udp-temp-timeout TEMPLATE_TIMEOUT Set UDP template timeout in seconds if --ipfix is set to udp. As per RFC 5101 recommendations, yaf will attempt to export templates three times within TEMPLATE_TIMEOUT. The default template timeout period is 600 seconds (10 minutes). --max-flows FLOW_TABLE_MAX If present, limit the number of open flows in the flow table to FLOW_TABLE_MAX by prematurely expiring the flows with the least re- cently received packets; this is analogous to an adaptive idle timeout. This option is provided to limit yaf resource usage when operating on data from large networks. By default, there is no flow table limit, and the flow table can grow to resource exhaustion. --max-payload PAYLOAD_OCTETS If present, capture at most PAYLOAD_OCTETS octets from the start of each direction of each flow when the flow's protocol is specified in --protocol-payload. If --max-payload is not given, yaf will not attempt to capture payload. Payload capture must be enabled for payload export (--export-payload), application labeling (--applabel), deep packet in- spection (yafdpi(1)), entropy evaluation (--entropy), and other fea- tures. As of yaf-2.18, PAYLOAD_OCTETS may include a k or K suffix to denote a multiple of kilobytes (1024); for example 4k is 4096. Note that payload capture is still an experimental feature. For TCP flows, the sequence numbers are used to ensure the payload is stored in the flow's payload buffer at the proper location, and bytes in the payload buffer are set to 0 for any "holes" caused by missing packets. For UDP flows, only payload from the first packet in each direction is captured by default. When --udp-payload is given, yaf captures data from all packets up to a maximum of PAYLOAD_OCTETS octets per direc- tion, and each direction's payload is stored in the order in which yaf receives the packets. Note when --udp-uniflow is active and applies to a flow record, the payload is associated with each single packet flow and not the final record. For non-TCP and non-UDP flow records, the flow's protocol must be spec- ified in --protocol-payload for payload to be captured, and only the payload from first packet in each direction is captured. --protocol-payload PROTOCOL[,PROTOCOL...] If present with --max-payload, capture payload for the specified IP protocols or for all protocols when a PROTOCOL is equal to 0. If not given, yaf captures payload for TCP(6) and UDP(17) flow records only. When this option is used, payload for TCP and UDP flows is only cap- tured when explicitly enabled by this option's argument. Since yaf-2.19.0. --udp-payload If present, capture payload from every packet in a UDP flow record up to PAYLOAD_OCTETS octets per direction, where PAYLOAD_OCTETS is set by --max-payload. Without this flag, only payload on the first packet in each direction is captured. See also --udp-uniflow. The payload is stored in the flow's payload buffer in the order in which yaf receives the packets. Prior to yaf-2.19.0, --udp-payload applied to all non-TCP records. --silk If present, export flows in "SiLK mode". As of yaf 2.0, this will ex- port TCP information (flags, ISN) in the main flow record instead of within the SubTemplateMultiList. This flag must be used when exporting to SiLK for it to collect TCP flow information. This also introduces the following incompatibilities with standard IPFIX export: * totalOctetCount and reverseTotalOctetCount are clamped to 32 bits. Any packet that would cause either of these counters to overflow 32 bits will cause the flow to close with flowEndReason 0x02 (active timeout), and will become the first packet of a new flow. This is analogous to forcing an active timeout when the octet counters overflow. * The high-order bit of the flowEndReason IE is set on any flow cre- ated on a counter overflow, as above. * The high-order bit of the flowEndReason IE is set on any flow cre- ated on an active timeout. Since this changes the semantics of the exported flowEndReason IE, it should only be used when generating flows and exporting to rwflow- pack(8), flowcap(8), or writing files for processing with rwip- fix2silk(1). --force-read-all If present, yaf will process out-of-sequence packets. However, it will still reject out-of-sequence fragments. --no-vlan-in-key If present, yaf will NOT use the VLAN ID in the flow key hash calcula- tion for flows. This means that packets within the active/idle time- outs that have the same 5-tuple (sIP, dIP, sport, dport, protocol) but different VLAN IDs will be aggregated into 1 flow and the VLAN ID of the first packet in each direction will be exported in the vlanId and reverseVlanId fields. Export Options These options are used to modify the data exported by yaf. --export-payload If present, export payload from each direction of each flow. By de- fault, yaf will not export flow payload. The maximum amount of payload exported for each direction is the smaller of the arguments to --max-payload and --max-export. For non-TCP flows, yaf only stores and exports payload from the first packet in each direction. See also --protocol-payload, --udp-payload, --udp-uniflow, and --payload-appla- bel-select. --payload-applabel-select APPLABEL_LIST Enable payload export (as --export-payload) but only for records whose application labels are specified in APPLABEL_LIST, a comma separated list of applabel values from 0 to 65535. Requires --applabel. Since yaf-2.13.0. --max-export MAX_PAY_EXPORT_OCTETS Enables payload export (as --export-payload) and limits yaf to export- ing at most MAX_PAY_EXPORT_OCTETS from the start of each direction of each flow. MAX_PAY_EXPORT_OCTETS must not be more than the argument to --max-payload. When --export-payload or --payload-applabel-select is specified without --max-export, all captured payload is exported. As of yaf-2.18, MAX_PAY_EXPORT_OCTETS may include a k or K suffix to de- note a multiple of kilobytes (1024); for example 4k is 4096. --uniflow If present, export biflows using the Record Adjacency method in section 3 of RFC 5103. This is useful when exporting to IPFIX Collecting Processes that are not biflow-aware. --mac If present, export MAC-layer information; presently, exports source and destination MAC addresses. --force-ip6-export If present, force IPv4 flows to be exported with IPv6-mapped IPv4 ad- dresses in ::FFFF/96. This will cause all flows to appear to be IPv6 flows. --observation-domain DOMAIN_ID Set the observationDomainId on each exported IPFIX message to the given integer value. If not present, the observationDomainId defaults to 0. This value is also used as the exportingProcessId in the yaf statistics Option Record as a Scope Field. --udp-uniflow PORT If specified, this option affects the export of UDP flow records, and it applies to all UDP records when PORT is 1 or to only those UDP records whose source or destination port matches PORT. If PORT is not 1, any UDP record that does not use PORT is processed normally. For the affected UDP records, yaf creates and exports the usual summary biflow records with the usual statistics, subject to normal idle and active time-outs, but without payload or DPI information. In addition, yaf creates and exports a single packet flow record for each UDP data- gram. These single packet records have their flowEndReason set to YAF_END_UDPFORCE, but otherwise they are no different than any other flow. If --max-payload is set, the datagram's first PAYLOAD_OCTETS octets of payload is associated with this single packet record, the payload is processed as for any other flow (by the application labeling engine, by plugins, et cetera), and the payload is exported if --ex- port-payload is given or --payload-applabel-select applies. --flow-stats If present, export extra flow attributes and statistics in the subTem- plateMultiList field. This will maintain information such as small packet count, large packet count, nonempty packet count, average in- ter-arrival times of packets, total data octets, and max packet size. See the "Flow Statistics Template" below for more information about each of the fields yaf exports. --delta If present, export octet and packet total counts in the delta count in- formation elements: octetTotalCount is exported in octetDeltaCount (IE 1), reverseOctetTotalCount is exported in reverseOctetDeltaCount, pack- etTotalCount is exported in packetDeltaCount (IE 2), and reversePacket- TotalCount is exported in reversePacketDeltaCount. --ingress INGRESS_INT If present, set the ingressInterface field in the flow template to INGRESS_INT. This field will also be populated if yaf was configured with --enable-daginterface or --enable-napatechinterface or --with-bivio. If yaf is running on a dag, napatech, or bivio, and the physical interface is available, this value will override INGRESS_INT. --egress EGRESS_INT If present, set the egressInterface field in the flow template to EGRESS_INT. This field will also be populated if yaf was configured with --enable-daginterface or --enable-napatechinterface or --with-bivio. If yaf is running on a dag, napatech, or bivio, and the physical interface is available, this value will override EGRESS_INT. --metadata-export If present, export template metadata (name and description) and infor- mation element metadata before data records. NOTE: This option was re- named from --template-info in YAF 2.11.0 --time-elements VALUE[,VALUE...] Selects the information elements to use for the start and end times in the exported flow records. For example, specifying --time-elements=1 causes the flow record to include the elements flowStartMilliseconds, flowEndMilliseconds, and (if the record is a bi-flow) reverse- FlowDeltaMilliseconds. Multiple VALUES may be given as a comma-sepa- rated list to export the record with multiple flow-start and end times. If the option is not specified, yaf uses both microsecond elements (the default precision for libpcap) and milliseconds elements (for compati- bility with prior releases). The choices are: 1Export fields flowStartMilliseconds, flowEndMilliseconds, and, for bi-flows, reverseFlowDeltaMilliseconds. 2Export fields flowStartMicroseconds, flowEndMicroseconds, and, for bi-flows, reverseFlowDeltaMicroseconds. 3Export fields flowStartNanoseconds, flowEndNanoseconds, and, for bi-flows, reverseFlowDeltaNanoseconds. Since yaf-2.16.0. Application Labeler Options If yaf is built with application labeler support enabled (using the --en- able-applabel option to ./configure when yaf is built), then yaf can exam- ine packet payloads and determine the application protocol in use within a flow, and export a 16-bit application label (often called an appLabel) with each flow. The exported application label uses the common port number for the proto- col. For example, HTTP traffic, independent of what port the traffic is detected on, will be labeled with a value of 80, the default HTTP port. Labels and rules are taken from a configuration file read at yaf startup time. Application labeling requires payload capture to be enabled with the --max-payload option. A minimum payload capture length of 384 octets is recommended for best results. Application labeling is presently experimental. SiLK supports IPFIX import and translation of the application label via rwflowpack(8), flowcap(8), and rwipfix2silk(1). --applabel If present, export application label data. Requires --max-payload to enable payload capture. --applabel-check-early APP_PAY_CHECK_EARLY Causes yaf to (attempt to) determine the application label when the amount of payload captured in a direction reaches APP_PAY_CHECK_EARLY octets. Without this option, yaf works as it always has and determines the application label when the flow is closed for any reason. APP_PAY_CHECK_EARLY may include a k or K suffix to denote a multiple of kilobytes (1024); for example 4k is 4096. Unless the --max-payload value is excessively large, the argument to this option should equal the argument to --max-payload, and it may not exceed --max-payload. With this option, once one direction's payload reaches APP_PAY_CHECK_EARLY octets, yaf performs application labeling using only that direction's payload. If application labeling fails, applica- tion labeling is attempted again when either the payload in other di- rection reaches APP_PAY_CHECK_EARLY octets or the flow is closed. This option is required (and only recommended) when the --appla- bel-max-payload option is used. This feature is experimental and may change in a future release. Since yaf-2.18.0. --applabel-max-payload APP=OCTETS[,APP=OCTETS...] Allows yaf to adjust the amount of payload stored on a flow record ac- cording to the flow record's application label. This option requires use of --applabel-check-early. The argument to this option is a comma-separated list of appLabel-octet pairs, where the appLabel and octet values are separated by an equals sign =, for example, 53=1024,443=4096 sets the per-direction payload of any DNS record to 1024 octets and TLS record to 4096 octets. The ap- pLabel must be a number from 0 to 65535 or the word "rest" which ap- plies to any appLabel not included in this option. If "rest" is not present, the maximum payload for any appLabel not named in this option is the value specified by --max-payload. The octets value may have one of four forms: * An integer between 0 and 4294967295. * An integer between 0 and 4194304 followed by k or K to denote a mul- tiple of kilobytes (1024). * A non-negative integer followed by a percent sign % to denote a per- centage of the argument to --max-payload. Percentages above 100 are allowed. * A non-negative floating point number to denote a multiple of the ar- gument to --max-payload. Factors above 1 are allowed. Using an octets value larger than --max-payload is allowed but it is not recommended: yaf initially collects only --max-payload octets of payload, and additional payload specified by this option may not be present on the record. The following allows records whose appLabels support DPI to keep their full payload and removes the payload from all other records: "--applabel-max-payload 21=100%,22=100%,25=100%,53=100%,69=100%,80=100%,110=100%,119=100%,143=100%,194=100%,427=100%,443=100%,502=100%,554=100%,3306=100%,5004=100%,5060=100%,5353=100%,5355=100%,20000=100%,44818=100%,rest=0" Use of this option may affect features such as --entropy, --ndpi, --fp- export, and others which run after the flow is closed and require ac- cess to the payload. This feature is experimental and may change in a future release. Since yaf-2.18.0. --applabel-rules RULES_FILE Read application labeler rules from RULES_FILE. When the option is not present, rules are read from the default location, /usr/lo- cal/etc/yaf/yafApplabelRules.conf. See applabel(1). nDPI Options nDPI is a version of OpenDPI as maintained by ntop. You can read more about nDPI and the applications supported at: <http://www.ntop.org/prod- ucts/deep-packet-inspection/ndpi/> If yaf is built with nDPI support enabled (using the --enable-ndpi option to ./configure when yaf is built), then yaf can examine packet payloads and determine the application protocol in use within a flow, and export the ap- plication protocol and sub-protocol with each flow. nDPI requires payload capture to be enabled with the --max-payload option. A minimum payload capture length of 384 octets is recommended for best re- sults. --ndpi If present, export nDPI data. Requires --max-payload to enable payload capture. --ndpi-protocol-file FILE Specify protocol file for sub-protocol and port-based protocol detec- tion Entropy Measurement If yaf is built with entropy measurement enabled (using the --enable-en- tropy option to ./configure when yaf is built,) then yaf can examine the packet payloads and determine a Shannon Entropy value for the payload. The entropy calculation does not include the network (IP) or transport (UDP/TCP) headers. The entropy is calculated in terms of bits per byte, (log base 2.) The calculation generates a real number value between 0.0 and 8.0. That number is then converted into an 8-bit integer value between 0 and 255. Roughly, numbers above 230 are generally compressed (or en- crypted) and numbers centered around approximately 140 are English text. Lower numbers carry even less information content. Another useful piece of information is that SSL/TLS tends to zero pad its packets, which causes the entropy of those flows to drop quite low. --entropy If present, export the entropy values for both the forward and reverse payloads. Requires the --max-payload option to operate. IPFIX Connection Options These options are used to configure the connection to an IPFIX collector. --ipfix-port PORT If --ipfix is present, export flows to TCP, UDP, or SCTP port PORT. If not present, the default IPFIX port 4739 is used. If --tls is also present, the default secure IPFIX port 4740 is used. --tls If --ipfix is present, use TLS to secure the connection to the IPFIX collector. Requires the TRANSPORT_PROTOCOL to be tcp, as DTLS over UDP or SCTP is not yet supported. Requires the --tls-ca, --tls-cert, and --tls-key options to specify the X.509 certificate and TLS key informa- tion. --tls-ca CA_PEM_FILE Use the Certificate Authority or Authorities in CA_PEM_FILE to verify the remote IPFIX Collecting Process' X.509 certificate. The connection to the Collecting Process will fail if its certificate was not signed by this CA (or by a certificate signed by this CA, recursively); this prevents export to unauthorized Collecting Processes. Required if --tls is present. --tls-cert CERT_PEM_FILE Use the X.509 certificate in CERT_PEM_FILE to identify this IPFIX Ex- porting Process. This certificate should contain the public part of the private key in KEY_PEM_FILE. Required if --tls is present. --tls-key KEY_PEM_FILE Use the private key in KEY_PEM_FILE for this IPFIX Exporting Process. This key should contain the private part of the public key in CERT_PEM_FILE. Required if --tls is present. If the key is encrypted, the password must be present in the YAF_TLS_PASS environment variable. --group SPREAD_GROUP_NAME If --ipfix is present and set to spread, use --group to specify the spread group name(s) to publish output. It is possible to list more than one group name in a comma-separated list. To use Spread as a man- ifold for different types of flows, use the format GROUP, GROUP_NAME:VALUE, GROUP_NAME:VALUE as the argument to --group and use the --groupby switch. This list should be contained in quotes if it contains spaces (yaf will ignore spaces in quotes). It is suggested to use one group as the catchall for all flows (no value listed) so flows are not lost. The --groupby switch must be used if --group uses GROUP:VALUE format. See the Spread Documentation, www.spread.org, for more details on Spread. --groupby GROUPBY_TYPE If --group is used with group values, use --groupby to specify what type of value should be used. Options are port, vlan, applabel, proto- col, version. --groupby accepts only one argument. The port option is destination transport port of the flow. version is the IP version of the flow. Privilege Options These options are used to cause yaf to drop privileges when running as root for live capture purposes. --become-user UNPRIVILEGED_USER After opening the live capture device in --live mode, drop privilege to the named user. Using --become-user requires yaf to be run as root or setuid root. This option will cause all files written by yaf to be owned by the user UNPRIVILEGED_USER and the user's primary group; use --become-group as well to change the group yaf runs as for output pur- poses. If running as root for live capture purposes and --become-user is not present, yaf will warn that privilege is not being dropped. We highly recommend the use of this option, especially in production environ- ments, for security purposes. --become-group UNPRIVILEGED_GROUP --become-group can be used to change the group from the default of the user given in --become-user. This option has no effect if given with- out the --become-user option as well. PCAP Options These options are used to turn on and configure yaf's PCAP export capabil- ity. Nearly all options in this section must be used in conjunction with --pcap, the exceptions are --pcap-meta-file and --index-pcap. yaf exits with an error when --pcap-per-flow and --hash are used together or are used without --pcap. --pcap PCAP_EXPORT_PATH The argument to this option specifies where yaf writes PCAP files, and its exact format depends on whether other options are present: If --pcap-per-flow is also present, yaf creates a separate PCAP file containing the packets used to create each flow record, and PCAP_EX- PORT_PATH is the name of the directory in which to create those files. See --pcap-per-flow for details. If --hash is present (optionally with --stime), yaf writes a single file containing the packets that match the arguments to those options, and PCAP_EXPORT_PATH is the name of that file. See --hash for this us- age. Otherwise, this option turns on rolling PCAP export, where yaf writes all network packets it captures and processes to multiple PCAP files, and PCAP_EXPORT_PATH is the directory and file prefix for the files. PCAP files will have names in the form of "PCAP_FILE_PREFIX[date- time]_[serialno].pcap", where [datetime] is the date-time printed as YYYYMMDDhhmmss, and [serialno] is a serial number of at least five dec- imal-digits. yaf writes to a file until the file size reaches --max-pcap octets (default of 25 MB) or after --pcap-timer seconds have passed (no default), whichever occurs first. Files are "locked" (yaf creates a second file by appending ".lock" to the filename) until yaf closes the file. yaf disables PCAP export if it is unable to write to a file; reasons for this include: an invalid directory in PCAP_EX- PORT_PATH, limits on the number of files in a directory, limits on the number of open files, and limits on file size. Hitting these limits may effect flow generation if yaf is also writing IPFIX files. Optionally, you may export meta-information about the flows in each rolling PCAP file with the --pcap-meta-file switch. --pcap-per-flow If present, yaf writes a pcap file for each flow in the output direc- tory given to --pcap, and the PCAP_EXPORT_PATH given to --pcap must be a file directory. This option is experimental and should only be used when reading pcap files of reasonable size. yaf only writes up to --max-payload bytes of each packet to the pcap file. Therefore, --max-payload must be set to an appropriate size to prevent packets from being truncated in the pcap file. yaf will use the last three digits of the flowStartMilliseconds as the directory and the flow key hash, flowStartMilliseconds, and serial number as the filename. See the included getFlowKeyHash(1) program to easily calculate the name of the file for a given flow. When the pcap file has reached --max-pcap size, yaf will close the file, increment the serial number, and open a new pcap file with the same naming convention. Note that your operating system has a limit to the number of open file handles yaf can maintain at any given time. Therefore, the performance of yaf degrades when the number of open flows is greater than the maximum number of file han- dles. It is an error to use this option without --pcap or with --hash. The --pcap-timer, --pcap-meta-file, and --index-pcap settings are ig- nored when --pcap-per-flow is used. --max-pcap MAX_FILE_MB If present, set the maximum file size of pcap files to MAX_FILE_MB MB. The default is 25 MB. This setting is ignored when the --hash option is present. --pcap-timer PCAP_ROTATE_DELAY If present, yaf will rotate rolling pcap files every PCAP_ROTATE_DELAY seconds or when the file reaches --max-pcap size, whichever happens first. By default, yaf only rotates files based on file size. This option is ignored when either --pcap-per-flow or --hash is used. --pcap-meta-file META_FILENAME If present, --pcap is also present, and neither --pcap-per-flow nor --hash is used, yaf exports metadata on the flows contained in each rolling pcap file yaf is writing to the filename specified by META_FILENAME. For each flow constructed from the packets in a pcap file, yaf writes a line in the form: flow_key_hash | flowStartMilliseconds | pcap_file_name If a flow exists across 3 pcap files, there will be 3 lines in META_FILENAME for that flow (each line having a different filename). The pcap-meta-file will rotate approximately every 4,500,000 lines (or approx 2G). A new file will be created in the form META_FILENAME[date- time]_serialno.meta. This file may be uploaded to a database for flow correlation and flow-to-pcap analysis. If --pcap-meta-file is given and none of --pcap, --pcap-per-flow, or --hash are present, yaf exports information about the pcap file(s) it is reading as opposed to the pcap files it is writing. See also --in- dex-pcap. --index-pcap This option changes the data written to the --pcap-meta-file to include the offset and length information about the packets. Specifically, yaf writes one line per packet to the pcap-meta-file in the form: flow_key_hash | flowStartMilliseconds | pcap_file_name/file_num | off- set | length If --pcap is present, the "pcap_file_name" is the name of the PCAP file yaf is writing. Otherwise, "file_num" represents the sequential file number that yaf has processed. If yaf was given a single pcap file, this number will always be 0. "offset" is the offset into the pcap file of the beginning of the packet, at the start of the pcap packet header. "length" is the length of the packet including the pcap packet header. Using this offset, a separate program, such as yafMeta2Pcap(1), will be able to quickly extract packets for a flow. This file only rotates if META_FILE reaches max size. --hash FLOW_KEY_HASH If present, yaf writes PCAP data for only the flow(s) having the speci- fied FLOW_KEY_HASH, and yaf writes the packets to the argument of the required --pcap option (PCAP_EXPORT_PATH), which is treated as a file name. You may pair this option with --stime to match flows having a specific start time. It is an error to use this option without --pcap or with --pcap-per-flow. The --max-pcap, --pcap-meta-file, --in- dex-pcap, and --pcap-timer options are ignored when --hash is used. --stime FLOW_START_TIMEMS If present, yaf writes PCAP data for only the flow(s) whose start time matches FLOW_START_TIMEMS and whose flow key hash matches the FLOW_KEY_HASH given to --hash. This option is only valid when used with the --hash and --pcap options. Logging Options These options are used to specify how log messages are routed. yaf can log to standard error, regular files, or the UNIX syslog facility. --log LOG_SPECIFIER Specifies destination for log messages. LOG_SPECIFIER can be a sys- log(3) facility name, the special value stderr for standard error, or the absolute path to a file for file logging. The default log specifier is stderr if available, user otherwise. --loglevel LOG_LEVEL Specify minimum level for logged messages. In increasing levels of ver- bosity, the supported log levels are quiet, error, critical, warning, message, info, and debug. The default logging level is warning. --verbose Equivalent to --loglevel debug. --version If present, print version and copyright information to standard error and exit. Plugin Options These options are used to load, configure, and run a yaf plugin. --plugin-name LIBPLUGIN_NAME[,LIBPLUGIN_NAME...] Specify the plugin to load. The loaded plugin must follow the yaf plu- gin framework. LIBPLUGIN_NAME must be the full path to the plugin li- brary name. Two plugins are included with c<yaf>, a Deep Packet In- spection plugin, and a DHCP Fingerprinting plugin. This flag will only be recognized if yaf is configured with --enable-plugins. There are also configure options to export only DNS Authoritative and NXDomain responses. Read each plugin's documentation for more information. --plugin-opts "OPTIONS[,OPTIONS...]" Specify the arguments to the plugin given to --plugin-name. This flag will only be recognized if yaf is configured with --enable-plugins and --plugin-name is set to a valid plugin. For example, the DPI Plugin takes the well-known port of a protocol(s) to enable DPI (default for DPI is all protocols). --plugin-conf CONF_FILE_PATH[,CONF_FILE_PATH...] Specify the path to a configuration file for the plugin given to --plu- gin-name. This flag will only be recognized if yaf is configured with --enable-plugins and --plugin-name is set to a valid plugin. If this switch is not used, but the plugin requires a configuration file, the default location /usr/local/etc/yaf will be used. Passive OS Fingerprinting (p0f) These options are used to enable p0f in yaf. p0f is presently experimental. There is no support in yafscii or SiLK for printing p0f related data. Cur- rently, yaf uses the p0f Version 2 SYN fingerprints (see p0f.fp). --p0fprint If present, export p0f data. This data consists of three related in- formation elements; osName, osVersion, osFingerPrint. This flag re- quires yaf to be configured with --enable-p0fprinter. --p0f-fingerprints Location of the p0f fingerprint file(s), p0f.fp. Default is /usr/lo- cal/etc/yaf/p0f.fp. This version of yaf includes the updated CERT p0f fingerprints. See <https://tools.netsa.cert.org/p0f/index.html> for updates. --fpexport If present, enable export of handshake headers for external OS finger- printers. The related information elements are firstPacketBanner and secondPacketBanner. This flag requires yaf to be configured with --en- able-fpexporter. OUTPUT Basic Flow Record yaf's output consists of an IPFIX message stream. yaf uses a variety of templates for IPFIX data records; the information elements that may appear in these templates are enumerated below. For further information about the IPFIX information model and IPFIX message stream, see RFC 5102, RFC 5101, and RFC 5103. As of yaf 2.0, yaf nests some templates in an IPFIX subTem- plateMultiList. In order to retain compatibility with the SiLK Tools, use --silk to prevent yaf from nesting TCP Information Elements. Below are de- scriptions of each of the templates yaf will export. See the Inter- net-Draft Export of Structured Data in IPFIX for more information on IPFIX lists. yaf assigns information element numbers to reverse flow elements in biflow capture based on the standard IPFIX PEN 29305. This applies only for in- formation elements defined in the standard IPFIX Information Model (RFC 5102) that do not have a reverse information element already defined. For information elements defined under the CERT PEN, a standard method is used to calculate their reverse element identifier. The method is that bit fourteen is set to one in the IE field, (e.g. 16384 + the forward IE num- ber.) flowStartMilliseconds IE 152, 8 octets, unsigned Flow start time in milliseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements is not specified or includes 1, and always present for releases before yaf-2.16.0. flowEndMilliseconds IE 153, 8 octets, unsigned Flow end time in milliseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements is not specified or includes 1, and always present for releases before yaf-2.16.0. flowStartMicroseconds IE 154, 8 octets, unsigned Flow start time in microseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements is not specified or includes 2. Since yaf-2.16.0. flowEndMicroseconds IE 155, 8 octets, unsigned Flow end time in microseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements is not specified or includes 2. Since yaf-2.16.0. flowStartNanoseconds IE 156, 8 octets, unsigned Flow start time in nanoseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements includes 3. Since yaf-2.16.0. flowEndNanoseconds IE 156, 8 octets, unsigned Flow end time in nanoseconds since 1970-01-01 00:00:00 UTC. Present when --time-elements includes 3. Since yaf-2.16.0. octetTotalCount IE 85, 8 octets, unsigned Number of octets in packets in forward direction of flow. Always present unless --delta is used. May be encoded in 4 octets using IPFIX reduced-length encoding. reverseOctetTotalCount Reverse (PEN 29305) IE 85, 8 octets, unsigned Number of octets in packets in reverse direction of flow. Present if flow has a reverse direction and --delta is not used. May be encoded in 4 octets using IPFIX reduced-length encoding. packetTotalCount IE 86, 8 octets, unsigned Number of packets in forward direction of flow. Always present unless --delta is used. May be encoded in 4 octets using IPFIX reduced-length encoding. reversePacketTotalCount Reverse (PEN 29305) IE 86, 8 octets, unsigned Number of packets in reverse direction of flow. Present if flow has a reverse direction and --delta is not used. May be encoded in 4 octets using IPFIX reduced-length encoding. octetDeltaCount IE 1, 8 octets, unsigned Number of octets in packets in forward direction of flow. Only present if --delta is used. May be encoded in 4 octets using IPFIX re- duced-length encoding. reverseOctetDeltaCount Reverse (PEN 29305) IE 1, 8 octets, unsigned Number of octets in reverse direction of flow. Only present if --delta is used and non-zero. May be encoded in 4 octets using IPFIX re- duced-length encoding. packetDeltaCount IE 2, 8 octets, unsigned Number of packets in forward direction of flow. Only present if --delta is used. May be encoded in 4 octets using IPFIX reduced-length encod- ing. reversePacketDeltaCount Reverse (PEN 29305) IE 2, 8 octets, unsigned Number of packets in reverse direction of flow. Only present if --delta is used and non-zero. May be encoded in 4 octets using IPFIX reduced-length encoding. reverseFlowDeltaMilliseconds CERT (PEN 6871) IE 21, 4 octets, unsigned Difference in times between the first packet in the forward direction and the first packet in the reverse direction, expressed in millisec- onds. Correlates with (but does not necessarily represent) round-trip time. Present if flow has a reverse direction and if --time-elements is not specified or includes 1. reverseFlowDeltaMicroseconds CERT (PEN 6871) IE 41, 8 octets, unsigned Difference in times between the first packet in the forward direction and the first packet in the reverse direction, expressed in microsec- onds. Correlates with (but does not necessarily represent) round-trip time. Present if flow has a reverse direction and if --time-elements is not specified or includes 2. reverseFlowDeltaNanoseconds CERT (PEN 6871) IE 42, 8 octets, unsigned Difference in times between the first packet in the forward direction and the first packet in the reverse direction, expressed in nanosec- onds. Correlates with (but does not necessarily represent) round-trip time. Present if flow has a reverse direction and if --time-elements includes 3. sourceIPv4Address IE 8, 4 octets, unsigned IPv4 address of flow source or biflow initiator. Present for IPv4 flows without IPv6-mapped addresses only. destinationIPv4Address IE 12, 4 octets, unsigned IPv4 address of flow source or biflow responder. Present for IPv4 flows without IPv6-mapped addresses only. sourceIPv6Address IE 27, 16 octets, unsigned IPv6 address of flow source or biflow initiator. Present for IPv6 flows or IPv6-mapped IPv4 flows only. destinationIPv6Address IE 28, 16 octets, unsigned IPv6 address of flow source or biflow responder. Present for IPv6 flows or IPv6-mapped IPv4 flows only. sourceTransportPort IE 7, 2 octets, unsigned TCP or UDP port on the flow source or biflow initiator endpoint. Al- ways present. destinationTransportPort IE 11, 2 octets, unsigned TCP or UDP port on the flow destination or biflow responder endpoint. Always present. For ICMP flows, contains ICMP type * 256 + ICMP code. This is non-standard, and an open issue in yaf. flowAttributes CERT (PEN 6871) IE 40, 2 octets, unsigned Miscellaneous flow attributes for the forward direction of the flow. Always present (yaf 2.1 or later). Current flag values, where 1 is the least significant bit: 1 - Fixed size All packets in the forward direction have fixed size. For TCP flows, only packets that have payload will be considered (to avoid TCP hand- shakes and teardowns). 2 - Out of Sequence One or more packets in the forward direction were received out-of-se- quence. 3 - MP_CAPABLE For TCP flows, this bit will be set if a packet in the flow was seen that had the MP_CAPABLE TCP option or attempted an MP_JOIN operation. 4 - Fragmented This bit is set if packets in the forward direction were reassembled from fragmented packets. reverseFlowAttributes CERT (PEN 6871) IE 16424, 2 octets, unsigned This is identical to flowAttributes but applies to packets in the re- verse direction of the flow. protocolIdentifier IE 4, 1 octet, unsigned IP protocol of the flow. Always present. flowEndReason IE 136, 1 octet, unsigned Flow end reason code, as defined by the IPFIX Information Model. Al- ways present. In --silk mode, the high-order bit is set if the flow was created by continuation. silkAppLabel CERT (PEN 6871) IE 33, 2 octets, unsigned Application label, defined as the primary well-known port associated with a given application. Present if the application labeler is en- abled, and was able to determine the application protocol used within the flow. vlanId IE 58, 2 octets, unsigned 802.1q VLAN tag of the first packet in the forward direction of the flow. reverseVlanId Reverse (PEN 29305) IE 58, 2 octets, unsigned 802.1q VLAN tag of the first packet in the reverse direction of the flow. Present if the flow has a reverse direction. ingressInterface IE 10, 4 octets, unsigned The index of the IP interface where packets of this flow are being re- ceived. Use --ingress, --napatech-interface, --dag-interface or con- figure yaf with bivio for this field to be present in the flow tem- plate. Use --ingress to manually set this field. egressInterface IE 14, 4 octets, unsigned The index of the IP interface where packets of this flow are being re- ceived. Use --egress, --napatech-interface, --dag-interface or config- ure yaf with bivio for this field to be present in the flow template. If using napatech, dag, or bivio, "egressInterface" will be the physi- cal interface | 0x100. Use b<--egress> to manually set this field. yafLayer2SegmentId CERT (PEN 6871) IE 934, 4 octets, unsigned Identifier of a layer 2 network segment in an overlay network. Present only if VxLAN decoding is enabled (--vxlan-decode or --geneve-decode). The most significant byte identifies the layer 2 network overlay net- work encapsulation type: 0x00: Reserved 0x01: VxLAN 0x02: NVGRE 0x03: Geneve The three lowest significant bytes hold the value of the layer 2 over- lay network segment identifier. ipClassOfService IE 5, 1 octet, unsigned For IPv4 packets, this is the value of the TOS field in the IPv4 header. For IPv6 packets, this is the Traffic Class field in the IPv6 header. reverseIpClassOfService Reverse (PEN 29305) IE 5, 1 octet, unsigned The TOS field in the IPv4 header for packets in the reverse direction, and Traffic Class field in the IPv6 header for packets in the reverse direction. mplsTopLabelStackSection IE 70, 3 octets The MPLS Label from the top of the MPLS label stack entry. yaf does not include the Experimental bits and Bottom of the Stack bit in the export field. yaf must have been enabled with MPLS support for export of this field. Note that this field is defined as an octet array in the default libfixbuf Information Model. yaf uses the length override feature in libfixbuf to redefine it from variable length to 3 bytes. mplsLabelStackSection2, IE 71, 3 octets The MPLS Label from the MPLS label stack entry immediately before the top entry. yaf does not include the Experimental bits and Bottom of the Stack bit in the export field. yaf must have been enabled with MPLS support for export of this field. Note that this field is defined as an octet array in the default libfixbuf Information Model. yaf uses the length override feature in libfixbuf to redefine it from variable length to 3 bytes. mplsLabelStackSection3, IE 72, 3 octets The MPLS Label from the third entry in the MPLS label stack. yaf does not include the Experimental bits and Bottom of the Stack bit in the export field. yaf must have been enabled with MPLS support for export of this field. Note that this field is defined as an octet array in the default libfixbuf Information Model. yaf uses the length override feature in libfixbuf to redefine it from variable length to 3 bytes. subTemplateMultiList IE 293, variable length Represents a list of zero or more instances of a structured data type, where the data type of each list element can be different and corre- sponds with different template definitions. The Information Element Number will change upon updates to the IPFIX lists specification and libfixbuf releases. TCP Flow Template The following six Information Elements will be exported as a template within the subTemplateMultiList unless --silk is used. tcpSequenceNumber IE 184, 4 octets, unsigned Initial sequence number of the forward direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP). This element is contained in the yaf TCP template within the subTemplateMultiList unless --silk is used. reverseTcpSequenceNumber Reverse (PEN 29305) IE 184, 4 octets, unsigned Initial sequence number of the reverse direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP) and the flow has a reverse direction. This element is contained in the yaf TCP template within the subTemplateMultiList unless --silk is used. initialTCPFlags CERT (PEN 6871) IE 14, 1 octet, unsigned TCP flags of initial packet in the forward direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP). This element is contained in the yaf TCP template within the subTemplateMultiList un- less --silk is used. unionTCPFlags CERT (PEN 6871) IE 15, 1 octet, unsigned Union of TCP flags of all packets other than the initial packet in the forward direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP). This element is contained in the yaf TCP template within the subTemplateMultiList unless --silk is used. reverseInitialTCPFlags CERT (PEN 6871) IE 16398, 1 octet, unsigned TCP flags of initial packet in the reverse direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP) and the flow has a reverse direction. This element is contained in the yaf TCP template within the subTemplateMultiList unless --silk is used. reverseUnionTCPFlags CERT (PEN 6871) IE 16399, 1 octet, unsigned Union of TCP flags of all packets other than the initial packet in the reverse direction of the flow. Present if the flow's protocolIdentifier is 6 (TCP) and the flow has a reverse direction. This element is con- tained in the yaf TCP template within the subTemplateMultiList unless --silk is used. MPTCP Template The following five Information Elements will be exported as a template within the subTemplateMultiList if any MPTCP options are seen. mptcpInitialDataSequenceNumber, CERT (PEN 6871) IE 289, 8 octets, unsigned The initial data sequence number found in the MPTCP Data Sequence Sig- nal (DSS) Option. mptcpReceiverToken, CERT (PEN 6871) IE 290, 4 octets, unsigned The token used to identify an MPTCP connection over multiple subflows. This value is found in the MP_JOIN TCP Option for the initial SYN of a subflow. mptcpMaximumSegmentSize, CERT (PEN 6871) IE 291, 2 octets, unsigned The maximum segment size reported in the Maximum Segment Size TCP Op- tion. This should be consistent over all subflows. mptcpAddressID, CERT (PEN 6871), IE 292, 1 octet, unsigned The address ID of the subflow found in the SYN/ACK of an MP_JOIN opera- tion. mptcpFlags, CERT (PEN 6871), IE 293, 1 octet, unsigned Various MPTCP Values: Bit 1: Priority was changed during the life of the subflow (MP_PRIO was seen) Bit 2: Subflow has priority at setup (backup flag was not set at ini- tialization). Bit 3: Subflow failed. (MP_FAIL option was seen). Bit 4: Subflow experienced fast close. (MP_FASTCLOSE options was seen). MAC Flow Template The following two Information Elements will be exported as a template within the subTemplateMultiList. sourceMacAddress, IE 56, 6 octets, unsigned Source MAC Address of the first packet in the forward direction of the flow. This element is contained in the yaf MAC template within the subTemplateMultiList. destinationMacAddress, IE 80, 6 octets, unsigned Destination MAC Address of the first packet in the reverse direction of the flow. This element is contained in the yaf MAC template within the subTemplateMultiList. Payload Flow Template The following two Information Elements will be exported as a template within the subTemplateMultiList. payload CERT (PEN 6871) IE 18, variable-length Initial n bytes of forward direction of flow payload. Present if pay- load collection is enabled and payload is present in the forward direc- tion of the flow. This element is contained in the yaf Payload template within the subTemplateMultiList. reversePayload CERT (PEN 6871) IE 16402, variable-length Initial n bytes of reverse direction of flow payload. Present if pay- load collection is enabled and payload is present in the reverse direc- tion of the flow. This element is contained in the yaf Payload template within the subTemplateMultiList. Entropy Flow Template The following two Information Elements will be exported as a template within the subTemplateMultiList. payloadEntropy CERT (PEN 6871) IE 35, 1 octet, unsigned Shannon Entropy calculation of the forward payload data. This element is contained in the yaf Entropy template within the subTemplateMulti- List. reversePayloadEntropy CERT (PEN 6871) IE 16419, 1 octet, unsigned Shannon Entropy calculation of the reverse payload data. This element is contained in the yaf Entropy template within the subTemplateMulti- List. p0f Flow Template The following six Information Elements will be exported as a template within the subTemplateMultiList if present and only if p0f is enabled. osName CERT (PEN 6871) IE 36, variable-length p0f OS Name for the forward flow based on the SYN packet and p0f SYN Fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. reverseOsName CERT (PEN 6871) IE 16420, variable-length p0f OS Name for the reverse flow based on the SYN packet and p0f SYN Fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. osVersion CERT (PEN 6871) IE 37, variable-length p0f OS Version for the forward flow based on the SYN packet and p0f SYN Fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. reverseOsVersion CERT (PEN 6871) IE 16421, variable-length p0f OS Version for the reverse flow based on the SYN packet and p0f SYN fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. osFingerPrint CERT (PEN 6871) IE 107, variable-length p0f OS Fingerprint for the forward flow based on the SYN packet and p0f SYN fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. reverseOsFingerPrint CERT (PEN 6871) IE 16491, variable-length p0f OS Fingerprint for the reverse flow based on the SYN packet and p0f SYN Fingerprints. Present only if p0f is enabled. This element is con- tained in the yaf p0f template within the subTemplateMultiList. Fingerprint Exporting Template The following four Information Elements will be exported as a template within the subTemplateMultiList if present and only if fpexport is enabled. firstPacketBanner CERT (PEN 6871) IE 38, variable-length IP and transport headers for first packet in forward direction to be used for external OS Fingerprinters. Present only if fpexport is en- abled. This element is contained in the yaf FPExport template within the subTemplateMultiList. reverseFirstPacketBanner CERT (PEN 6871) IE 16422, variable-length IP and transport headers for first packet in reverse direction to be used for external OS Fingerprinters. Present only if fpexport is en- abled. This element is contained in the yaf FPExport template within the subTemplateMultiList. secondPacketBanner CERT (PEN 6871) IE 39, variable-length IP and transport headers for second packet in forward direction (third packet in sequence) to be used for external OS Fingerprinters. Present only if fpexport is enabled. This element is contained in the yaf FPEx- port template within the subTemplateMultiList. reverseSecondPacketBanner CERT (PEN 6871) IE 16423, variable-length IP and transport headers for second packet in reverse direction (cur- rently not used). Present only if fpexport is enabled. This element is contained in the yaf FPExport template within the subTemplateMultiList. Hooks Templates yaf can export other templates within the subTemplateMultiList if plugins are enabled in yaf. See yafdpi(1) for descriptions of the yaf Deep Packet Inspection Information Elements. See yafdhcp(1) for descriptions of the DHCP Fingerprint Information Elements. Flow Statistics Template yaf can maintain and export more information about each flow than what is exported in the Basic Flow Template. If yaf is run with --flow-stats yaf will export the following attributes with every flow as long as one of the following characteristics is nonzero. The following flow attributes have been known to help in traffic classification. dataByteCount CERT (PEN 6871) IE 502, 8 octets, unsigned Total bytes transferred as payload. averageInterarrivalTime CERT (PEN 6871) IE 503, 8 octets, unsigned Average number of milliseconds between packets. standardDeviationInterarrivalTime CERT (PEN 6871) IE 504, 8 octets, un- signed Standard deviation of the inter-arrival time for up to the first ten packets. tcpUrgTotalCount IE 223, 4 octets, unsigned The number of TCP packets that have the URGENT Flag set. smallPacketCount CERT (PEN 6871) IE 500, 4 octets, unsigned The number of packets that contain less than 60 bytes of payload. nonEmptyPacketCount CERT (PEN 6871) IE 501, 4 octets, unsigned The number of packets that contain at least 1 byte of payload. largePacketCount CERT (PEN 6871) IE 510, 4 octets, unsigned The number of packets that contain more than 225 bytes of payload. firstNonEmptyPacketSize CERT (PEN 6871) IE 505, 2 octets, unsigned Payload length of the first non-empty packet. maxPacketSize CERT (PEN 6871) IE 506, 2 octets, unsigned The largest payload length transferred in the flow. standardDeviationPayloadLength CERT (PEN 6871) IE 508, 2 octets, unsigned The standard deviation of the payload length for up to the first 10 non empty packets. firstEightNonEmptyPacketDirections CERT (PEN 6871) IE 507, 1 octet, un- signed Represents directionality for the first 8 non-empty packets. 0 for for- ward direction, 1 for reverse direction. reverseDataByteCount CERT (PEN 6871) IE 16886, 8 octets, unsigned Total bytes transferred as payload in the reverse direction. reverseAverageInterarrivalTime CERT (PEN 6871) IE 16887, 8 octets, unsigned Average number of milliseconds between packets in reverse direction. reverseStandardDeviationInterarrivalTime CERT (PEN 6871) IE 16888, 8 octets, unsigned Standard deviation of the inter-arrival time for up to the first ten packets in the reverse direction. reverseTcpUrgTotalCount Reverse (PEN 29305), IE 223, 4 octets, unsigned The number of TCP packets that have the URGENT Flag set in the reverse direction. reverseSmallPacketCount CERT (PEN 6871) IE 16884, 4 octets, unsigned The number of packets that contain less than 60 bytes of payload in re- verse direction. reverseNonEmptyPacketCount CERT (PEN 6871) IE 16885, 4 octets, unsigned The number of packets that contain at least 1 byte of payload in re- verse direction. reverseLargePacketCount CERT (PEN 6871) IE 16894, 4 octets, unsigned The number of packets that contain more than 225 bytes of payload in the reverse direction. reverseFirstNonEmptyPacketSize CERT (PEN 6871) IE 16889, 2 octets, unsigned Payload length of the first non-empty packet in the reverse direction. reverseMaxPacketSize CERT (PEN 6871) IE 16890, 2 octets, unsigned The largest payload length transferred in the flow in the reverse di- rection. reverseStandardDeviationPayloadLength CERT (PEN 6871) IE 16892, 2 octets, unsigned The standard deviation of the payload length for up to the first 10 non empty packets in the reverse direction. Statistics Options Template yaf will export information about its process periodically using IPFIX Op- tions Template Record. This record gives information about the status of the flow and fragment table, as well as decoding information. This can be turned off using the --no-stats option. The following Information Elements will be exported: systemInitTimeMilliseconds IE 161, 8 octets, unsigned The time in milliseconds of the last (re-)initialization of yaf. exportedFlowRecordTotalCount IE 42, 8 octets, unsigned Total amount of exported flows from yaf start time. packetTotalCount IE 86, 8 octets, unsigned Total amount of packets processed by yaf from yaf start time. droppedPacketTotalCount IE 135, 8 octets, unsigned Total amount of dropped packets according to statistics given by libp- cap, libdag, or the Napatech or Netronome APIs. ignoredPacketTotalCount IE 164, 8 octets, unsigned Total amount of packets ignored by the yaf packet decoder, such as un- supported packet types and incomplete headers, from yaf start time. notSentPacketTotalCount IE 167, 8 octets, unsigned Total amount of packets rejected by yaf because they were received out of sequence. expiredFragmentCount CERT (PEN 6871) IE 100, 4 octets, unsigned Total amount of fragments that have been expired since yaf start time. assembledFragmentCount CERT (PEN 6871) IE 101, 4 octets, unsigned Total number of packets that been assembled from a series of fragments since yaf start time. flowTableFlushEventCount CERT (PEN 6871) IE 104, 4 octets, unsigned Total number of times the yaf flow table has been flushed since yaf start time. flowTablePeakCount CERT (PEN 6871) IE 105, 4 octets, unsigned The maximum number of flows in the yaf flow table at any one time since yaf start time. exporterIPv4Address IE 130, 4 octets, unsigned The IPv4 Address of the yaf flow sensor. exportingProcessId IE 144, 4 octets, unsigned Set the ID of the yaf flow sensor by giving a value to --observa- tion-domain. The default is 0. meanFlowRate CERT (PEN 6871) IE 102, 4 octets, unsigned The mean flow rate of the yaf flow sensor since yaf start time, rounded to the nearest integer. meanPacketRate CERT (PEN 6871) IE 103, 4 octets, unsigned The mean packet rate of the yaf flow sensor since yaf start time, rounded to the nearest integer. Tombstone Options Template yaf will export tombstone records periodically using IPFIX Options Template Records. These records are intended to allow the analysis of the time it takes for records to be processed by each tool (eg. YAF, Super Mediator, SiLK) in your environment. Each tombstone record generated by yaf consists of six information elements: the observation domain ID set by the --obser- vation- domain argument, the exporting process ID which is the PID of the YAF process, a user- settable tombstone ID, a sequentially increasing "tombstoneId" for each record, the timestamp of the record's creation, and a subTemplateList of the time each program interacted with the tombstone record. With ideal randomness and/or proper user arguments, the 4 IDs taken together should uniquely specify a record. Tombstone records are only ac- tive when stats are active and can be individually turned off using the --no-tombstone option. The following Information Elements will be exported: observationDomainId IE 149, 4 octets, unsigned The (user-set) observation domain of the YAF sensor. exportingProcessId IE 144, 2 octets, unsigned The PID of the YAF sensor. exporterConfiguredId CERT (PEN 6871) IE 551, 2 octets, unsigned An identification number for the record that is user specifiable at runtime and shared across all records in a run of the given program. tombstoneId CERT (PEN 6871) IE 550, 4 octets, unsigned A sequentially increasing identification number unique to each tomb- stone record in a run of a given program. observationTimeSeconds IE 322, 4 octets, dateTimeSeconds The UNIX timestamp of when the record was created. tombstoneAccessList CERT (PEN 6871) IE 554, variable length, subTem- plateList A subTemplateList consisting of Tombstone Access Templates (see below) that specify when each program that supports tombstone times-tamping interacted with the tombstone record. Tombstone Access Template The following two Information Elements will be exported as a template within the subTemplateList of a Tombstone Options Template: certToolId CERT (PEN 6871) IE 553, 4 octets, unsigned The identification number of the program that interacted with the record. yaf has and ID of 1. observationTimeSeconds IE 322, 4 octets, dateTimeSeconds The UNIX timestamp of when the program interacted with the record. SIGNALS yaf responds to SIGINT or SIGTERM by terminating input processing, flushing any pending flows to the current output, and exiting. If --verbose is given, yaf responds to SIGUSR1 (and SIGINFO where available) by printing present flow and fragment table statistics to its log. All other signals are handled by the C runtimes in the default manner on the platform on which yaf is currently operating. EXAMPLES To generate flows from an pcap file into an IPFIX file: "yaf --in packets.pcap --out flows.yaf" To capture flows from a pcap interface and export them to files in the cur- rent directory rotated hourly: "yaf --live pcap --in en1 --out en1_capture --rotate 3600" To capture flows from an Endace DAG card and export them via IPFIX over TCP: "yaf --live dag --in dag0 --ipfix tcp --out my-collector.example.com" To capture flows from a Napatech Adapter card using stream ID 20 and export them via IPFIX over UDP: yaf --live napatech --in nt3g20 --ipfix udp --out localhost --ipfix-port 18000 To capture flows from a Netronome NFE card and export to a file: "yaf --live netronome --in 0:0 --out /data/yaf/myipfix.yaf" To convert a pcap formatted packet capture into IPFIX: "yaf <packets.pcap >flows.yaf" To publish to spread group TST_SPRD for a spread daemon running locally on port 4803: "yaf --live pcap --in eth1 --out 4803@localhost --ipfix spread --group TST_SPRD" To publish to spread groups based on application label for spread daemon running locally on port 4803: "yaf --live pcap --in eth1 --out 4803@localhost --ipfix spread --group "SPRD_CATCHALL, SPRD_DNS:53, SPRD_HTTP:80, SPRD_SMTP:25" --groupby applabel --applabel --max-payload=400" To run yaf with application labeling enabled and export via IPFIX over TCP: "yaf --live pcap --in eth1 --out 127.0.0.1 --ipfix tcp --ipfix-port=18001 --applabel --applabel-rules=/usr/local/etc/yaf/yafApplabelRules.conf --max-payload=300" To run yaf with BPF on UDP Port 53 "yaf --live pcap --in en1 --out /path/to/dst/ --rotate 120 --filter="udp port 53"" To run yaf with Deep Packet Inspection enabled for HTTP, IMAP, and DNS: "yaf --in packets.pcap --out flows.yaf --applabel --max-payload=400 --plu- gin-name=/usr/local/lib/yaf/dpacketplugin.la --plugin-opts="80 143 53"" To run yaf with Deep Packet Inspection and DHCP Fingerprinting: "yaf --in packets.pcap --out flows.yaf --applabel --max-payload=1000 --plu- gin-name=/usr/local/lib/yaf/dpacketplugin.la,/usr/lo- cal/lib/yaf/dhcp_fp_plugin.la" To run yaf with pcap generation: "yaf --in eth0 --live pcap --out localhost --ipfix tcp --ipfix-port=18001 --pcap /data/pcap --pcap-meta-file=/data/pcap_info" To generate a pcap file for one particular flow in a pcap: "yaf --in packets.pcap --no-output --max-payload=2000 --pcap /data/one- flow.pcap --hash 2181525080 --stime 1407607897547" KNOWN ISSUES YAF BPF Filtering is ignored when using --live dag, napatech, or netronome because libpcap is not used. YAF PCAP Export options are ignored when using --live dag, napatech, or netronome. YAF requires libfixbuf 2.3.0 or later. YAF 2.0 must be used with an IPFIX Collecting Process that can handle IPFIX lists elements, especially the subTemplateMultiList Information Element in order to retrieve certain flow information. Older versions of YAF can read YAF 2.0 flow files, but will ignore anything contained in the subTemplate- MultiList. The plugin infrastructure has been modified in YAF 2.0 to export templates in YAF's subTemplateMultiList element. YAF 2.0 will export statistics in an Options Template and Options Data Records unless the --no-stats switch is given. The IPFIX Collecting Process should be able to differentiate between options records and flow records in order to prevent incorrect transcoding of statistics records into flow records. YAF will not rotate output files if it is not seeing any flow data. How- ever, it will continue to write process statistics messages at the config- ured interval time to the most recent output file. When using PF_RING ZC with yaf, a load balancing program is required. See yafzcbalance(1) for more information. When running yaf with --live=pfring or --live=zc, the call to receive pack- ets is blocking so yaf will not export statistics messages or respond to SIGUSR1 / SIGINFO signals unless it is receiving data. Presently, the destinationTransportPort information element contains ICMP type and code information for ICMP or ICMP6 flows; this is nonstandard and may not be interoperable with other IPFIX implementations. Bug reports and feature requests may be sent via email to <netsa-help@cert.org>. ENVIRONMENT LTDL_LIBRARY_PATH Specifies a directory or a colon-separated list of directories where yaf should look for its plugin files. By default yaf checks /usr/lo- cal/lib/yaf. TMPDIR Specifies the directory where yaf should compressed PCAP files for pro- cessing. If not set, yaf uses /tmp. YAF_MAX_FLOWS_PERCENTAGE Specifies what percentage of flows to keep open when the number of ac- tive flows exceeds the maximum table size (set by --max-flows). This value must be an integer from 1 to 99 inclusive and it is treated as a percentage of --max-flows. Its default value is 95. Since yaf-2.19.0. YAF_CLOSE_QUEUE_THRESHOLD Specifies the minimum number of closed flows that causes yaf to flush its flow table. This may be any positive integer value. Its default value is 2500. Since yaf-2.19.0. YAF_FLUSH_DELAY Limits how often yaf flushes the flow table absent meeting another cri- terion (reaching --max-flows or exceeding YAF_CLOSE_QUEUE_THRESHOLD). This value is specified in milliseconds and it may be any integer value greater than 100. Its default is 2500. Since yaf-2.19.0. YAF_ALIGNMENT_CHECK If true, causes yaf to print, to the standard error, details about the internal structures yaf uses when mapping memory into IPFIX templates. The value is considered true unless its value is the empty string or the first character of its value is '0', '"F"', or '"f"'. FILES /usr/local/etc/yaf/yafApplabelRules.conf The default location of the application labeling configuration file when --applabel-rules is not specified. See applabel(1). /usr/local/etc/yaf/yafDPIRules.conf The default location of the deep packet inspection configuration file used by the dpacketplugin plug-in. See yafdpi(1). /usr/local/lib/yaf/ The default directory where yaf searches for plug-in files. AUTHORS Brian Trammell, Chris Inacio, Michael Duggan, Emily Sarneso, Dan Ruef, Matt Coates, and the CERT Network Situational Awareness Group Engineering Team. SEE ALSO yafscii(1), applabel(1), yafdpi(1), yafdhcp(1), yafMeta2Pcap(1), get- FlowKeyHash(1), yafzcbalance(1), filedaemon(1), tcpdump(1), pcap(3), rwip- fix2silk(1), rwflowpack(8), flowcap(8), nafalize(1), gzip(1), Spread Docu- mentation at <https://www.spread.org/>, libp0f at <https://tools.netsa.cert.org/p0f/libp0f.html>, and the following IETF In- ternet RFCs: Specification of the IPFIX Protocol for the Exchange of IP Traffic Flow Information RFC 5101, Information Model for IP Flow Informa- tion Export RFC 5102, Bidirectional Flow Export using IPFIX RFC 5103, Ex- port of Structured Data in IPFIX RFC 6313 2.19.3 4-Aug-2026 YAF(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | OUTPUT | SIGNALS | EXAMPLES | KNOWN ISSUES | ENVIRONMENT | FILES | AUTHORS | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=yaf&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>