silk (yaf/rwfilter)

rwfilter --start-date=2026/11/01 --any-address=<ip> --pass=out.rw

Filters SiLK flows (CERT's NetFlow analysis toolkit) by IP and date, extracting a host's communications from a flow file.

Run it when you have SiLK (the CERT/NetSA flow analysis toolkit, with yaf capturing and rwfilter querying) and need to filter flows for a specific IP: rwfilter selects by addresses, ports, protocols, and dates, and writes the result to a .rw file that is then processed with rwstats, rwcount, or rwcut. It's the flow analysis tool for teams with CERT infrastructure: powerful, fast on huge volumes (SiLK binary format), and designed for IR. Typical case: all flows from the compromised IP during the incident period, ready for communications analysis.

Don't use it without knowing the SiLK ecosystem: the .rw binary format and tools (rwfilter, rwcut, rwstats) form their own workflow — mixing with nfdump or files from other collectors won't work without conversion. The filters are powerful but the syntax is specific (--any-address, --pass, --start-date): parameter errors give empty or partial results. And watch out: like all NetFlow, these are metadata — volume and destinations, not content; and quality depends on capture (yaf on the segment, or router export). For quick analysis of a handful of flows, nfdump is more direct; SiLK shines on massive volumes and statistical analysis.