{"id":146,"date":"2018-07-08T20:41:56","date_gmt":"2018-07-08T11:41:56","guid":{"rendered":"https:\/\/www.chohi.ga\/?p=146"},"modified":"2018-07-20T10:58:04","modified_gmt":"2018-07-20T01:58:04","slug":"silkthe-system-for-internet-level-knowledg-%eb%ac%b4%ec%a1%b0%ea%b1%b4-%eb%94%b0%eb%9d%bc%ed%95%98%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/www.kkoc.org\/?p=146","title":{"rendered":"SiLK(the System for Internet-Level Knowledg) \ubb34\uc870\uac74 \ub530\ub77c\ud558\uae30"},"content":{"rendered":"

SiLK \ub2e4\uc6b4\ub85c\ub4dc<\/h1>\n
https:\/\/tools.netsa.cert.org\/<\/pre>\n
LBNL-05 \ud6c8\ub828\uc6a9 \ub370\uc774\ud130<\/h1>\n
https:\/\/tools.netsa.cert.org\/silk\/referencedata.html<\/pre>\n
\ucef4\ud30c\uc77c<\/h1>\n
#> make\r\n#> make install\u00a0 \u00a0 <- root<\/pre>\n
rwcut<\/h2>\n
[chohi@www SiLK-LBNL-05]$ rwcut inweb\/2005\/01\/06\/iw-S0_20050106.20 | more\r\nsIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime| duration| eTime|sen|\r\n148.19.251.179| 128.3.148.48| 2497| 80| 6| 16| 2631|FS PA 2005\/01\/06T20:01:54.119| 0.246|2005\/01\/06T20:01:54.365| ?|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6| 14| 2159| S PA 2005\/01\/06T20:01:54.160| 0.260|2005\/01\/06T20:01:54.420| ?|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6| 2| 80|F A 2005\/01\/06T20:07:07.845| 0.003|2005\/01\/06T20:07:07.848| ?|\r\n56.71.233.157| 128.3.148.48|48906| 80| 6| 5| 300| S 2005\/01\/06T20:01:50.011| 45.003|2005\/01\/06T20:02:35.014| ?|\r\n56.96.13.225| 128.3.148.48|50722| 80| 6| 6| 360| S 2005\/01\/06T20:02:57.132| 272.990|2005\/01\/06T20:07:30.122| ?|\r\n56.96.13.225| 128.3.148.48|50726| 80| 6| 6| 360| S 2005\/01\/06T20:02:57.432| 272.990|2005\/01\/06T20:07:30.422| ?|\r\n58.236.56.129| 128.3.148.48|32621| 80| 6| 3| 144| S 2005\/01\/06T20:12:10.747| 9.747|2005\/01\/06T20:12:20.494| ?|\r\n56.96.13.225| 128.3.148.48|54497| 443| 6| 6| 360| S 2005\/01\/06T20:09:30.124| 272.989|2005\/01\/06T20:14:03.113| ?|\r\n56.96.13.225| 128.3.148.48|54500| 80| 6| 6| 360| S 2005\/01\/06T20:09:30.423| 272.990|2005\/01\/06T20:14:03.413| ?|\r\n\r\nhttps:\/\/tools.netsa.cert.org\/silk\/rwcut.html<\/pre>\n
 <\/p>\n
\ud544\ub4dc \uc21c\uc11c \uc9c0\uc815 \uc608<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwcut --field=1-5 inweb\/2005\/01\/06\/iw-S0_20050106.20 | head -4\r\nsIP| dIP|sPort|dPort|pro|\r\n148.19.251.179| 128.3.148.48| 2497| 80| 6|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6|<\/pre>\n
\ucd9c\ub825\uc21c\uc11c \ubc0f \uceec\ub7fc\uba85\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwcut --field=5,1,2,3,4 inweb\/2005\/01\/06\/iw-S0_20050106.20 | head -4 \r\npro| sIP| dIP|sPort|dPort|\r\n6| 148.19.251.179| 128.3.148.48| 2497| 80|\r\n6| 148.19.251.179| 128.3.148.48| 2498| 80|\r\n6| 148.19.251.179| 128.3.148.48| 2498| 80|\r\n[chohi@www SiLK-LBNL-05]$ rwcut --field=sIP,dIP,proto inweb\/2005\/01\/06\/iw-S0_20050106.20 | head -4 \r\nsIP| dIP|pro|\r\n148.19.251.179| 128.3.148.48| 6|\r\n148.19.251.179| 128.3.148.48| 6|\r\n148.19.251.179| 128.3.148.48| 6|<\/pre>\n
\uc9c0\uc815\ud55c \ubc94\uc704 \ub808\ucf54\ub4dc \ucd9c\ub825<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwcut --field=1-9 inweb\/2005\/01\/06\/iw-S0_20050106.20 --start-rec-num=3 --end-rec-num=5\r\nsIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6| 2| 80|F A |2005\/01\/06T20:07:07.845|\r\n56.71.233.157| 128.3.148.48|48906| 80| 6| 5| 300| S |2005\/01\/06T20:01:50.011|\r\n56.96.13.225| 128.3.148.48|50722| 80| 6| 6| 360| S |2005\/01\/06T20:02:57.132|<\/pre>\n
rwfilter<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfilter --dport=80 inweb\/2005\/01\/06\/iw-S0_20050106.20 --pass=stdout | rwcut --field=1-9 --num-recs=5\r\nsIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime|\r\n148.19.251.179| 128.3.148.48| 2497| 80| 6| 16| 2631|FS PA |2005\/01\/06T20:01:54.119|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6| 14| 2159| S PA |2005\/01\/06T20:01:54.160|\r\n148.19.251.179| 128.3.148.48| 2498| 80| 6| 2| 80|F A |2005\/01\/06T20:07:07.845|\r\n56.71.233.157| 128.3.148.48|48906| 80| 6| 5| 300| S |2005\/01\/06T20:01:50.011|\r\n56.96.13.225| 128.3.148.48|50722| 80| 6| 6| 360| S |2005\/01\/06T20:02:57.132|\r\n\r\n[chohi@www SiLK-LBNL-05]$ rwfilter --dport=4350-4360 inweb\/2005\/01\/06\/iw-S0_20050106.20 --pass=stdout | rwcut --field=1-9 \r\nsIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime|\r\n218.131.115.42| 131.243.105.35| 80| 4360| 6| 2| 80|F A |2005\/01\/06T20:24:21.879|\r\n148.19.96.160|131.243.107.239| 80| 4350| 6| 27| 35445|FS PA |2005\/01\/06T20:59:42.451|\r\n148.19.96.160|131.243.107.239| 80| 4352| 6| 4| 709|FS PA |2005\/01\/06T20:59:42.507|\r\n148.19.96.160|131.243.107.239| 80| 4351| 6| 15| 16938|FS PA |2005\/01\/06T20:59:42.501|\r\n148.19.96.160|131.243.107.239| 80| 4353| 6| 4| 704|FS PA |2005\/01\/06T20:59:42.544|\r\n148.19.96.160|131.243.107.239| 80| 4354| 6| 21| 27071|FS PA |2005\/01\/06T20:59:46.729|\r\n148.19.96.160|131.243.107.239| 80| 4355| 6| 7| 7588| S A |2005\/01\/06T20:59:46.801|\r\n148.19.96.160|131.243.107.239| 80| 4355| 6| 5| 7500| PA |2005\/01\/06T20:59:46.819|\r\n148.19.96.160|131.243.107.239| 80| 4356| 6| 4| 709|FS PA |2005\/01\/06T20:59:46.814|\r\n148.19.96.160|131.243.107.239| 80| 4357| 6| 4| 704|FS PA |2005\/01\/06T20:59:46.845|\r\n148.19.96.160|131.243.107.239| 80| 4358| 6| 21| 26044|FS PA |2005\/01\/06T20:59:57.905|\r\n148.19.96.160|131.243.107.239| 80| 4359| 6| 10| 9188|FS PA |2005\/01\/06T20:59:58.001|\r\n148.19.96.160|131.243.107.239| 80| 4360| 6| 15| 16938|FS PA |2005\/01\/06T20:59:58.041|\r\n148.19.96.160|131.243.107.239| 80| 4352| 6| 1| 40| A |2005\/01\/06T20:59:42.516|\r\n148.19.96.160|131.243.107.239| 80| 4353| 6| 1| 40| A |2005\/01\/06T20:59:42.552|\r\n148.19.96.160|131.243.107.239| 80| 4356| 6| 1| 40| A |2005\/01\/06T20:59:46.823|\r\n148.19.96.160|131.243.107.239| 80| 4357| 6| 1| 40| A |2005\/01\/06T20:59:46.852|<\/pre>\n
TCP \ud50c\ub798\uadf8<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
\ubb38\uc790<\/strong><\/span><\/td>\n\ud50c\ub798\uadf8<\/strong><\/span><\/td>\n\ube44\uace0<\/strong><\/span><\/td>\n<\/tr>\n
F<\/td>\nFIN<\/td>\n\u00a0<\/td>\n<\/tr>\n
S<\/td>\nSYN<\/td>\n\u00a0<\/td>\n<\/tr>\n
R<\/td>\nRSET<\/td>\n\u00a0<\/td>\n<\/tr>\n
P<\/td>\nPSH<\/td>\n\u00a0<\/td>\n<\/tr>\n
A<\/td>\nACK<\/td>\n\u00a0<\/td>\n<\/tr>\n
U<\/td>\nURG<\/td>\n\u00a0<\/td>\n<\/tr>\n
E<\/td>\nECE<\/td>\n\u00a0<\/td>\n<\/tr>\n
C<\/td>\nCWR<\/td>\n\u00a0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
 <\/p>\n
\uc694\uc57d\ub41c \ud2b8\ub798\ud53d \uc815\ubcf4 \ucd9c\ub825<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfilter --print-volume-stat in\/2005\/01\/07\/in-S0_20050107.01 --proto=0-255 \r\n| Recs| Packets| Bytes| Files|\r\nTotal| 2019| 2730488| 402105501| 1|\r\nPass| 2019| 2730488| 402105501| |\r\nFail| 0| 0| 0| |\r\n[chohi@www SiLK-LBNL-05]$ rwfilter --print-stat in\/2005\/01\/07\/in-S0_20050107.01 --proto=0-255 \r\nFiles 1. Read 2019. Pass 2019. Fail 0.<\/pre>\n
rwfileinfo<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfileinfo in\/2005\/01\/07\/in-S0_20050107.01\r\nin\/2005\/01\/07\/in-S0_20050107.01:\r\nformat(id) FT_RWAUGMENTED(0x14)\r\nversion 2\r\nbyte-order littleEndian\r\ncompression(id) none(0)\r\nheader-length 28\r\nrecord-length 28\r\nrecord-version 2\r\nsilk-version 0\r\ncount-records 2019\r\nfile-size 56560\r\npacked-file-info 2005\/01\/07T01:00:00Z ? ?<\/pre>\n
rwcount -load scheme<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --all=stdout | rwcount --bin-size=1800\r\nDate| Records| Bytes| Packets|\r\n2005\/01\/07T01:00:00| 257.58| 42827381.72| 248724.14|\r\n2005\/01\/07T01:30:00| 1589.61| 211453506.60| 1438751.93|\r\n2005\/01\/07T02:00:00| 171.81| 147824612.67| 1043011.93|<\/pre>\n
rwset\uacfc ip \uc9d1\ud569<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --all=stdout | rwset --sip-file=sip.set --dip-file=dip.set\r\n[chohi@www SiLK-LBNL-05]$ ls -al *.set\r\n-rw-rw-r-- 1 chohi chohi 642 7\uc6d4 6 09:18 dip.set\r\n-rw-rw-r-- 1 chohi chohi 15150 7\uc6d4 6 09:18 sip.set\r\n[chohi@www SiLK-LBNL-05]$ rwsetcat sip.set | head -5\r\n0.0.0.0\r\n32.16.40.178\r\n32.24.41.181\r\n32.24.215.49\r\n32.30.13.177\r\n[chohi@www SiLK-LBNL-05]$ rwfileinfo sip.set\r\nsip.set:\r\nformat(id) FT_IPSET(0x1d)\r\nversion 16\r\nbyte-order littleEndian\r\ncompression(id) none(0)\r\nheader-length 138\r\nrecord-length 1\r\nrecord-version 2\r\nsilk-version 3.17.2\r\ncount-records 15012\r\nfile-size 15150\r\ncommand-lines \r\n1 rwfilter --all=stdout in\/2005\/01\/07\/in-S0_20050107.01\r\n2 rwset --sip-file=sip.set --dip-file=dip.set\r\n\r\n[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --pass=stdout --aport=123 | rwcut | head -5\r\nsIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime| duration| eTime|sen|\r\n56.7.90.229| 128.3.23.152| 123| 123| 17| 1| 76| |2005\/01\/07T01:10:00.603| 0.000|2005\/01\/07T01:10:00.603| ?|\r\n192.41.221.11| 128.3.23.152| 123| 123| 17| 1| 76| |2005\/01\/07T01:10:15.519| 0.000|2005\/01\/07T01:10:15.519| ?|\r\n87.221.134.185| 128.3.23.231| 123| 123| 17| 1| 76| |2005\/01\/07T01:24:46.256| 0.000|2005\/01\/07T01:24:46.256| ?|\r\n137.230.203.1| 128.3.63.40| 123| 123| 17| 1| 76| |2005\/01\/07T01:24:51.587| 0.000|2005\/01\/07T01:24:51.587| ?|\r\n[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --aport=123 --print-stat\r\nFiles 1. Read 2019. Pass 52. Fail 1967.\r\n\r\n[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --all=stdout | rwuniq --field=sip,proto | head -4\r\nsIP|pro| Records|\r\n35.223.112.236| 1| 1|\r\n211.210.215.142| 6| 1|\r\n151.151.237.231| 17| 4|<\/pre>\n
rwbag<\/p>\n
[chohi@www SiLK-LBNL-05]$ rwfilter in\/2005\/01\/07\/in-S0_20050107.01 --all=stdout | rwbag --sip-bytes=sip_bytes.bag\r\n[chohi@www SiLK-LBNL-05]$ rwbagcat sip_bytes.bag | head -5\r\n0.0.0.0| 328|\r\n32.16.40.178| 480|\r\n32.24.41.181| 39|\r\n32.24.215.49| 39|\r\n32.30.13.177| 39|<\/pre>\n
\uace0\uae09 SiLK \uae30\ub2a5<\/h1>\n
pmaps<\/h2>\n
[chohi@www SiLK-LBNL-05]$ cat reserver.txt\r\n##\r\n#\r\nlabel 0 1918-reserved\r\nlabel 1 multicast\r\nlabel 2 future\r\nlabel 3 normal\r\n#\r\n#\r\n#\r\nmode ip\r\n#\r\n#\r\ndefault normal\r\n#map\r\n192.168.0.0\/16 1918-reserved\r\n10.0.0.0\/8 1918-reserved\r\n172.16.0.0\/12 1918-reserved\r\n224.0.0.0\/4 multicast\r\n224.0.0.0\/4 future\r\n\r\n[chohi@www SiLK-LBNL-05]$ rwpmapbuild --input-file reserver.txt --output-file reserve.pmap\r\n[chohi@www SiLK-LBNL-05]$ ls -al re*.*\r\n-rw-rw-r-- 1 chohi chohi 415 7\uc6d4 8 17:15 reserve.pmap\r\n-rw-rw-r-- 1 chohi chohi 241 7\uc6d4 8 17:15 reserver.txt\r\n\r\n[chohi@www SiLK-LBNL-05]$ rwcut --pmap-file=reserve:reserve.pmap --fields=1-4,src-reserve,dst-reserve traceroute.rwf | head -5\r\nrwcut: Error opening file 'traceroute.rwf': No such file or directory\r\n<\/pre>\n
 <\/p>\n
traceroute.rwf \ud30c\uc77c\uc5d0 \ub300\ud55c \ub0b4\uc6a9\uc774 \uc5c6\uc5b4\uc11c \uc6b0\uc120 skip. \uc624\ub958\uc785\ub2c8\ub2e4.<\/p>\n
\uace0\uae09\uae30\ub2a5 \uc0ac\uc6a9 \ubabb\ud558\uace0 \uc9c0\ub098\uac11\ub2c8\ub2e4.<\/p>\n
 <\/p>\n
SiLK \ub370\uc774\ud130 \uc218\uc9d1\ud558\uae30<\/h1>\n
YAF\uc124\uce58<\/h2>\n
https:\/\/tools.netsa.cert.org\/yaf\/download.html<\/pre>\n
configure \uc624\ub958\ubc1c\uc0dd<\/h2>\n
[chohi@www yaf-2.10.0]$ .\/configure\u00a0\r\n\r\n...\r\n\r\nchecking for GLIB - version >= 2.4.7... no\r\n*** Could not run GLIB test program, checking why...\r\n*** The test program failed to compile or link. See the file config.log for the\r\n*** exact error that occured. This usually means GLIB is incorrectly installed.\r\nconfigure: error: Cannot find a suitable glib2 (>= 2.4.7)<\/pre>\n
 <\/p>\n
glib2 \ubc84\uc804\ud655\uc778\ud6c4 dependent\ub97c \uc124\uce58\ud569\ub2c8\ub2e4.<\/p>\n
[root@www yaf-2.10.0]# rpm -qa | grep glib2\r\nglib2-2.54.2-2.el7.x86_64\r\n[root@www yaf-2.10.0]# yum install glib2-devel<\/pre>\n
configure: error: Cannot find a suitable libfixbuf (>= 2.0.0) (Try setting PKG_CONFIG_PATH): No package 'libfixbuf' found\r\nNo package 'libfixbuf' found<\/pre>\n
 <\/p>\n
libfixbuf \ub2e4\uc6b4\ub85c\ub4dc<\/p>\n
https:\/\/tools.netsa.cert.org\/fixbuf\/download.html<\/pre>\n
 <\/p>\n
libfixbuf \uc124\uce58<\/p>\n
[root@www libfixbuf-1.8.0]# .\/configure\r\n\r\n[root@www libfixbuf-1.8.0]# make\r\n\r\n[root@www libfixbuf-1.8.0]# make install<\/pre>\n
PCAP lib \uc124\uce58<\/h2>\n
yum install libpcap-devel<\/pre>\n
YAF \uc124\uce58 \uacc4\uc18d<\/h2>\n
[root@www yaf-2.10.0]# .\/configure\r\n[root@www yaf-2.10.0]# make\u00a0\r\n[root@www yaf-2.10.0]# make install\r\n[root@www yaf-2.10.0]# which yaf\r\n\/usr\/local\/bin\/yaf<\/pre>\n
\uc0ac\uc6a9\ubc95 \ucc38\uc870<\/h2>\n
https:\/\/tools.netsa.cert.org\/yaf\/yaf.html<\/pre>\n
 <\/p>\n
Configuring YAF with SiLK<\/h3>\n
https:\/\/tools.netsa.cert.org\/yaf\/libyaf\/yaf_silk.html<\/p>\n
 <\/p>\n
\uc9c4\ud589\uc911.\u00a0<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
SiLK \ub2e4\uc6b4\ub85c\ub4dc https:\/\/tools.netsa.cert.org\/ LBNL-05 \ud6c8\ub828\uc6a9 \ub370\uc774\ud130 https:\/\/tools.netsa.cert.org\/silk\/referencedata.html \ucef4\ud30c\uc77c #> make #> make install\u00a0 \u00a0 <- root rwcut [chohi@www SiLK-LBNL-05]$ rwcut inweb\/2005\/01\/06\/iw-S0_20050106.20 | more sIP| dIP|sPort|dPort|pro| packets| bytes| flags| sTime| duration| eTime|sen| 148.19.251.179| 128.3.148.48| 2497| 80| 6| 16| 2631|FS… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/146"}],"collection":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=146"}],"version-history":[{"count":15,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/146\/revisions"}],"predecessor-version":[{"id":224,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=\/wp\/v2\/posts\/146\/revisions\/224"}],"wp:attachment":[{"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kkoc.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}