# Install silk with Homebrew Collection of traffic analysis tools. Version 3.24.2 via Homebrew; verified 2026-05-14. ## Install ```sh sudo av install brew:silk ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install silk ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:silk - **Package manager:** Homebrew - **Package manager page:** - **Version:** 3.24.2 - **Source summary:** Collection of traffic analysis tools - **Homepage:** - **Upstream docs:** - **License:** GPL-2.0-or-later AND LGPL-2.1-or-later - **Source archive:** - **Last updated:** 2026-05-14T21:28:11Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - flowcap (cli) - mapsid (cli) - num2dot (cli) - rwaddrcount (cli) - rwaggbag (cli) - rwaggbagbuild (cli) - rwaggbagcat (cli) - rwaggbagtool (cli) - rwallformats (cli) - rwappend (cli) - rwbag (cli) - rwbagbuild (cli) - rwbagcat (cli) - rwbagtool (cli) - rwcat (cli) - rwcombine (cli) - rwcompare (cli) - rwcount (cli) - rwcut (cli) - rwdedupe (cli) - rwfglob (cli) - rwfileinfo (cli) - rwfilter (cli) - rwflowappend (cli) - rwflowpack (cli) - rwgeoip2ccmap (cli) - rwgroup (cli) - rwguess (cli) - rwidsquery (cli) - rwip2cc (cli) - rwipfix2silk (cli) - rwmatch (cli) - rwnetmask (cli) - rwp2yaf2silk (cli) - rwpackchecker (cli) - rwpcut (cli) - rwpdedupe (cli) - rwpdu2silk (cli) - rwpmapbuild (cli) - rwpmapcat (cli) - rwpmaplookup (cli) - rwpmatch (cli) - rwpollexec (cli) - rwptoflow (cli) - rwrandomizeip (cli) - rwreceiver (cli) - rwrecgenerator (cli) - rwresolve (cli) - rwscan (cli) - rwsender (cli) - rwset (cli) - rwsetbuild (cli) - rwsetcat (cli) - rwsetmember (cli) - rwsettool (cli) - rwsilk2ipfix (cli) - rwsiteinfo (cli) - rwsort (cli) - rwsplit (cli) - rwstats (cli) - rwswapbytes (cli) - rwtotal (cli) - rwtuc (cli) - rwuniq (cli) - silk_config (cli) - flowcap (alias) - mapsid (alias) - num2dot (alias) - rwaddrcount (alias) - rwaggbag (alias) - rwaggbagbuild (alias) - rwaggbagcat (alias) - rwaggbagtool (alias) - rwallformats (alias) - rwappend (alias) - rwbag (alias) - rwbagbuild (alias) - rwbagcat (alias) - rwbagtool (alias) - rwcat (alias) - rwcombine (alias) - rwcompare (alias) - rwcount (alias) - rwcut (alias) - rwdedupe (alias) - rwfglob (alias) - rwfileinfo (alias) - rwfilter (alias) - rwflowappend (alias) - rwflowpack (alias) - rwgeoip2ccmap (alias) - rwgroup (alias) - rwguess (alias) - rwidsquery (alias) - rwip2cc (alias) - rwipfix2silk (alias) - rwmatch (alias) - rwnetmask (alias) - rwp2yaf2silk (alias) - rwpackchecker (alias) - rwpcut (alias) - rwpdedupe (alias) - rwpdu2silk (alias) - rwpmapbuild (alias) - rwpmapcat (alias) - rwpmaplookup (alias) - rwpmatch (alias) - rwpollexec (alias) - rwptoflow (alias) - rwrandomizeip (alias) - rwreceiver (alias) - rwrecgenerator (alias) - rwresolve (alias) - rwscan (alias) - rwsender (alias) - rwset (alias) - rwsetbuild (alias) - rwsetcat (alias) - rwsetmember (alias) - rwsettool (alias) - rwsilk2ipfix (alias) - rwsiteinfo (alias) - rwsort (alias) - rwsplit (alias) - rwstats (alias) - rwswapbytes (alias) - rwtotal (alias) - rwtuc (alias) - rwuniq (alias) - silk_config (alias) ## Dependencies - gettext - glib - libfixbuf - yaf ## Build dependencies - pkgconf ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 3.24.2 - Package-manager updated: 2026-05-14 - Local data: ok - Upstream repository: https://tools.netsa.cert.org/silk/ - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage SiLK, the System for Internet-Level Knowledge, is CERT NetSA's suite for collecting, storing, and analyzing large volumes of network flow data. It combines collection daemons with many command-line analysis tools for querying binary SiLK Flow repositories. ### Project history The official credits describe SiLK as a CERT Network Situational Awareness project that grew out of earlier large-scale analysis work associated with Suresh Lakshman Konda. The public release notes list releases from SiLK 0.1 in December 2003 through 3.24.2 in May 2026. The project has evolved from early NetFlow-oriented tooling into a broader flow-analysis suite with IPFIX, NetFlow v5/v9, PySiLK, plug-ins, IPsets, Bags, prefix maps, scan detection, and service packaging material. ### Adoption history The official site positions SiLK for backbone, enterprise border, and mid-sized ISP traffic analysis, and the input records a Homebrew package. The official downloads page also documents RPM availability for recent releases, reflecting use by Unix and Linux operators. ### How it is used Operators run packing tools such as flowcap and rwflowpack to collect IPFIX or NetFlow data into a SiLK data repository, then use analysis commands such as rwfilter, rwcut, rwstats, rwuniq, rwset, and rwbag in pipelines to answer security questions over historical flow data. ### Why package nerds care Package nerds care because SiLK is a large, old-school Unix tool suite with dozens of executables, daemon/service configuration, C/Perl/Python components, generated manpages, and data-file compatibility concerns. Packaging it means making a full operational network-analysis environment available from a package manager. ### Timeline - 2003: Official release notes list SiLK 0.1. - 2008: Official release notes list SiLK 1.0.0. - 2011: Official release notes list SiLK 3.0.0. - 2017: Official release notes list SiLK 4.0.0 beta software while 3.x continues. - 2026: Official downloads page lists SiLK 3.24.2. ### Related projects - Related projects and components include YAF, libfixbuf, IPFIX, NetFlow, PySiLK, rwflowpack, flowcap, rwfilter, and the broader CERT NetSA Security Suite. ### Sources - - - - - - source_facts.package-manager ## Security Notes No matching local secret-handling manifest was found for silk. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ${SILK_CONFIG_FILE}, ${SILK_DATA_ROOTDIR}/silk.conf, /data/silk.conf, ${SILK_PATH}/share/silk/silk.conf, ${SILK_PATH}/share/silk.conf, /usr/share/silk/silk.conf, /usr/share/silk.conf, /etc/rwflowpack.conf, $prefix/etc/rwflowpack.conf ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** silk - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [gettext](https://www.automicvault.com/pkg/brew/gettext/) - Runtime dependency declared by Homebrew. - [glib](https://www.automicvault.com/pkg/brew/glib/) - Runtime dependency declared by Homebrew. - [yaf](https://www.automicvault.com/pkg/brew/yaf/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [ssldump](https://www.automicvault.com/pkg/brew/ssldump/) - Shares av.db curated category or tags: cli, network-analysis, security. - [sslsplit](https://www.automicvault.com/pkg/brew/sslsplit/) - Shares av.db curated category or tags: cli, network-analysis, security. - [zeek](https://www.automicvault.com/pkg/brew/zeek/) - Shares av.db curated category or tags: cli, network-security, security, traffic-analysis. - [arpoison](https://www.automicvault.com/pkg/brew/arpoison/) - Shares av.db curated category or tags: cli, network-security, security. - [bettercap](https://www.automicvault.com/pkg/brew/bettercap/) - Shares av.db curated category or tags: cli, network-security, security. - [ettercap](https://www.automicvault.com/pkg/brew/ettercap/) - Shares av.db curated category or tags: cli, network-security, security, traffic-analysis. - [fragroute](https://www.automicvault.com/pkg/brew/fragroute/) - Shares av.db curated category or tags: cli, network-security, security. - [killswitch](https://www.automicvault.com/pkg/brew/killswitch/) - Shares av.db curated category or tags: cli, network-security, security. ## Combined YAML source View the package source record on GitHub. [combined/silk.yml](https://github.com/automic-vault/db/blob/main/combined/silk.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph