Automic VaultAutomic Vault

brew

Install silk with Homebrew

Collection of traffic analysis tools. Version 3.24.2 via Homebrew; verified 2026-05-14.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified ยท 100%
brew install silk

local Homebrew formula metadata

overview

Package summary

Collection of traffic analysis tools

Commands and aliases

  • flowcap
  • mapsid
  • num2dot
  • rwaddrcount
  • rwaggbag
  • rwaggbagbuild
  • rwaggbagcat
  • rwaggbagtool
  • rwallformats
  • rwappend
  • rwbag
  • rwbagbuild
  • rwbagcat
  • rwbagtool
  • rwcat
  • rwcombine
  • rwcompare
  • rwcount
  • rwcut
  • rwdedupe
  • rwfglob
  • rwfileinfo
  • rwfilter
  • rwflowappend
  • rwflowpack
  • rwgeoip2ccmap
  • rwgroup
  • rwguess
  • rwidsquery
  • rwip2cc
  • rwipfix2silk
  • rwmatch

history

Project history and usage

SiLK, the System for Internet-Level Knowledge, is CERT NetSA's suite for collecting, storing, and analyzing large volumes of network flow data. It combines collection daemons with many command-line analysis tools for querying binary SiLK Flow repositories.

Project history

The official credits describe SiLK as a CERT Network Situational Awareness project that grew out of earlier large-scale analysis work associated with Suresh Lakshman Konda. The public release notes list releases from SiLK 0.1 in December 2003 through 3.24.2 in May 2026.

The project has evolved from early NetFlow-oriented tooling into a broader flow-analysis suite with IPFIX, NetFlow v5/v9, PySiLK, plug-ins, IPsets, Bags, prefix maps, scan detection, and service packaging material.

Adoption history

The official site positions SiLK for backbone, enterprise border, and mid-sized ISP traffic analysis, and the input records a Homebrew package. The official downloads page also documents RPM availability for recent releases, reflecting use by Unix and Linux operators.

How it is used

Operators run packing tools such as flowcap and rwflowpack to collect IPFIX or NetFlow data into a SiLK data repository, then use analysis commands such as rwfilter, rwcut, rwstats, rwuniq, rwset, and rwbag in pipelines to answer security questions over historical flow data.

Why package nerds care

Package nerds care because SiLK is a large, old-school Unix tool suite with dozens of executables, daemon/service configuration, C/Perl/Python components, generated manpages, and data-file compatibility concerns. Packaging it means making a full operational network-analysis environment available from a package manager.

Timeline

  • 2003: Official release notes list SiLK 0.1.
  • 2008: Official release notes list SiLK 1.0.0.
  • 2011: Official release notes list SiLK 3.0.0.
  • 2017: Official release notes list SiLK 4.0.0 beta software while 3.x continues.
  • 2026: Official downloads page lists SiLK 3.24.2.

Related projects

  • Related projects and components include YAF, libfixbuf, IPFIX, NetFlow, PySiLK, rwflowpack, flowcap, rwfilter, and the broader CERT NetSA Security Suite.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for silk. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Installs with 4 runtime dependencies.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
${SILK_CONFIG_FILE}${SILK_DATA_ROOTDIR}/silk.conf/data/silk.conf${SILK_PATH}/share/silk/silk.conf${SILK_PATH}/share/silk.conf/usr/share/silk/silk.conf/usr/share/silk.conf/etc/rwflowpack.conf$prefix/etc/rwflowpack.conf

executables

Installed executables

CommandKindExposureNote
flowcapcliglobal executable
mapsidcliglobal executable
num2dotcliglobal executable
rwaddrcountcliglobal executable
rwaggbagcliglobal executable
rwaggbagbuildcliglobal executable
rwaggbagcatcliglobal executable
rwaggbagtoolcliglobal executable
rwallformatscliglobal executable
rwappendcliglobal executable
rwbagcliglobal executable
rwbagbuildcliglobal executable
rwbagcatcliglobal executable
rwbagtoolcliglobal executable
rwcatcliglobal executable
rwcombinecliglobal executable
rwcomparecliglobal executable
rwcountcliglobal executable
rwcutcliglobal executable
rwdedupecliglobal executable
rwfglobcliglobal executable
rwfileinfocliglobal executable
rwfiltercliglobal executable
rwflowappendcliglobal executable
rwflowpackcliglobal executable
rwgeoip2ccmapcliglobal executable
rwgroupcliglobal executable
rwguesscliglobal executable
rwidsquerycliglobal executable
rwip2cccliglobal executable
rwipfix2silkcliglobal executable
rwmatchcliglobal executable
rwnetmaskcliglobal executable
rwp2yaf2silkcliglobal executable
rwpackcheckercliglobal executable
rwpcutcliglobal executable
rwpdedupecliglobal executable
rwpdu2silkcliglobal executable
rwpmapbuildcliglobal executable
rwpmapcatcliglobal executable
rwpmaplookupcliglobal executable
rwpmatchcliglobal executable
rwpollexeccliglobal executable
rwptoflowcliglobal executable
rwrandomizeipcliglobal executable
rwreceivercliglobal executable
rwrecgeneratorcliglobal executable
rwresolvecliglobal executable
rwscancliglobal executable
rwsendercliglobal executable
rwsetcliglobal executable
rwsetbuildcliglobal executable
rwsetcatcliglobal executable
rwsetmembercliglobal executable
rwsettoolcliglobal executable
rwsilk2ipfixcliglobal executable
rwsiteinfocliglobal executable
rwsortcliglobal executable
rwsplitcliglobal executable
rwstatscliglobal executable
rwswapbytescliglobal executable
rwtotalcliglobal executable
rwtuccliglobal executable
rwuniqcliglobal executable
silk_configcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version3.24.2
manager updated2026-05-14
local dataok
upstreamnot checked
latest detectednot detected

https://tools.netsa.cert.org/silk/

install metadata

Package metadata

Package keybrew:silk
Version3.24.2
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/silk
Homepagehttps://tools.netsa.cert.org/silk/
Upstream docshttps://tools.netsa.cert.org/silk/docs.html
LicenseGPL-2.0-or-later AND LGPL-2.1-or-later
Source archivehttps://tools.netsa.cert.org/releases/silk-3.24.2.tar.gz
Last updated2026-05-14T21:28:11Z
Pulseupdated
Dependenciesgettext, glib, libfixbuf, yaf
Build dependenciespkgconf
Uses from macOSlibpcap
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namesilk
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • gettextRuntime dependency declared by Homebrew.
  • glibRuntime dependency declared by Homebrew.
  • yafRuntime dependency declared by Homebrew.
  • pkgconfBuild dependency declared by Homebrew.

Same workflow

  • ssldumpShares av.db curated category or tags: cli, network-analysis, security.
  • sslsplitShares av.db curated category or tags: cli, network-analysis, security.
  • zeekShares av.db curated category or tags: cli, network-security, security, traffic-analysis.
  • arpoisonShares av.db curated category or tags: cli, network-security, security.
  • bettercapShares av.db curated category or tags: cli, network-security, security.
  • ettercapShares av.db curated category or tags: cli, network-security, security, traffic-analysis.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • package relationship graph
  • package version freshness
  • package-page enrichment