=pod

=head1 NAME

B<rwipfix2silk> - Convert IPFIX records to SiLK Flow records

=head1 SYNOPSIS

  rwipfix2silk [--silk-output=FILE] [--print-statistics] [IPFIX_FILES...]

=head1 DESCRIPTION

B<rwipfix2silk> reads IPFIX (Internet Protocol Flow Information
eXport) records from the input files specified on the command line or
from the standard input when no files are specified, converts the
records to the SiLK Flow format, and writes the SiLK records to the
path specified by B<--silk-output> or to the standard output when
stdout is not the terminal and B<--silk-output> is not provided.

When C<stdin> is provided as an input file name, B<rwipfix2silk> will
read records from the standard input.

=head1 OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an
exact match for an option.  A parameter to an option may be specified
as B<--arg>=I<param> or B<--arg> I<param>, though the first form is
required for options that take optional parameters.

=over 4

=item B<--silk-output>=I<FILE>

Write the SiLK records to I<FILE>, which must not exist.  If the
switch is not provided or if I<FILE> has the value C<stdout>, the
SiLK flows are written to the standard output.

=item B<--print-statistics>

Print, to the standard error, the number of records that were written
to the SiLK output file, and the number of forward and reverse records
that were seen.

=back

=head1 EXAMPLES

To convert a packet capture (B<pcap(3)>) file, F<packets.dat>, such as
that produced by B<tcpdump(1)>, to the SiLK format, you could use the
B<yaf> tool (see L<http://tools.netsa.cert.org/yaf/>):

  yaf --silk --in packets.dat --out - \
      | rwipfix2silk --silk-output=silk.dat

To convert the file back into an IPFIX format:

  rwsilk2ipfix --silk-output=silk2.rwf ipfix.dat

=head1 SEE ALSO

B<rwsilk2ipfix(1)>, B<yaf(1)>

=cut

$SiLK: rwipfix2silk.pod 7334 2007-05-30 15:42:13Z mthomas $

Local Variables:
mode:text
indent-tabs-mode:nil
End: