silk-rwreceiver - SiLK Toolset: File Transfer Receiver

Distribution: Fedora 25
Repository: CERT Forensics Tools i386
Package name: silk-rwreceiver
Package version: 3.14.0
Package release: 1.fc25
Package architecture: i686
Package type: rpm
Installed size: 283.55 KB
Download size: 145.00 KB
Official Mirror:
SiLK, the System for Internet-Level Knowledge, is a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. The SiLK tool suite supports the efficient collection, storage and analysis of network flow data, enabling network security analysts to rapidly query large historical traffic data sets. SiLK is ideally suited for analyzing traffic on the backbone or border of a large, distributed enterprise or mid-sized ISP. The silk-rwreceiver package contains a program (rwreceiver) which receives files over the network from one or more rwsender programs. rwsender-rwreceiver pairs are used to move files from a machine running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.



  • config(silk-rwreceiver) = 3.14.0-1.fc25
  • silk-rwreceiver = 3.14.0-1.fc25
  • silk-rwreceiver(x86-32) = 3.14.0-1.fc25


    Install Howto

    1. Download cert-forensics-tools-release-25 rpm:
    2. Install cert-forensics-tools-release-25 rpm:
      # rpm -Uvh cert-forensics-tools-release*rpm
    3. Install silk-rwreceiver rpm package:
      # dnf --enablerepo=forensics install silk-rwreceiver


    • /etc/init.d/rwreceiver
    • /etc/sysconfig/rwreceiver.conf
    • /usr/sbin/rwreceiver
    • /usr/share/man/man8/rwreceiver.8.gz
    • /var/silk/


    2016-11-17 - Lawrence Rogers <> 3.14.0-1/2 * Release 3.14.0-1/2 IPset changes Add a new file format, record-version=5, for IPsets containing IPv6 addresses that should be more compact than record-version=4. Unless the default file format is changed at configure time, the new format must be explicitly requested using --record-version switch or via the SILK_IPSET_RECORD_VERSION environment variable. Fix a bug when working with IPsets that contain IPv6 addresses and have more than 44,739,242 internal nodes. The bug may cause the tool to crash or to loop endlessly. Reduce how quickly memory grows when building an IPset that contains IPv6 addresses. Perform additional integrity checks when reading an IPset file from disk. rwsetbuild Fix a bug introduced in SiLK-3.11.0 that may occur when computing the intersection or difference of an IPv4 IPset with an IPv6 IPset that is in record-version=4 format. Addresses in the ::ffff:0:0/96 netblock of the IPv6 IPset were ignored when the IPset contained clusters of addresses less then ::ffff:0:0. rwsetcat Allow computing the count of IP addresses in an IPset without loading the IPset into memory. rwbag Fix a bug when creating a bag whose key is attributes that causes the bag to appear to have duplicate keys. rwfileinfo Rename the title of the compression field. The title was changed unintentionally in SiLK 3.12.2 and caused iSiLK to fail. rwstats, rwuniq Do not limit the maximum hash table size to a 32-bit value on a 64-bit platform. flowcap, rwflowpack In the sensor.conf file, add support for a quirk to handle NetFlow v9 records generated by a SonicWall device where the router up-time is reported in seconds instead of milliseconds. Building Add a configure switch, --enable-ipset-compatibility, that allows changing the default IPset file format written by SiLK. The argument is the version of SiLK with which IPsets are to be compatible. The IPset file format changes at 3.7.0 and 3.14.0.

    2016-09-29 - Lawrence Rogers <> 3.13.0-1/2 * Release 3.13.0-1/2 Change across all tools Add support for compressing files with "Snappy" compression when the Snappy library and header are found during configuration. Add support for the SILK_COMPRESSION_METHOD environment variable that provides a default value for the --compression-method switch. rwcount Do not limit the maximum array size to a 32-bit value on 64-bit platforms. rwsettool Add a --symmetric-difference switch to compute the set of IP addresses that occur in only one of two input IPsets. rwfileinfo Disable printing of the record count when the file's compression method is not available. rwfilter, rwfglob Fix a file-selection bug where a --start-date specified in epoch seconds that fell on a day boundary would return files for that entire day instead of for that single hour. PySiLK Fix memory leaks. Fix a bug in the where an epoch-based start-date value that fell on a day boundary would return files for that entire day instead of for that single hour. rwsender Change the log messages that are written when scanning the incoming and processing directories.