SiLK, the System for Internet-Level Knowledge, is a collection of
traffic analysis tools developed by the CERT Network Situational
Awareness Team (CERT NetSA) to facilitate security analysis of large
networks. The SiLK tool suite supports the efficient collection,
storage and analysis of network flow data, enabling network security
analysts to rapidly query large historical traffic data sets. SiLK is
ideally suited for analyzing traffic on the backbone or border of a
large, distributed enterprise or mid-sized ISP.
The silk-rwflowappend package is used when the final storage location
of SiLK data files is on a different machine than that where the files
are created by the rwflowpack daemon (see the silk-rwflowpack
package). rwflowappend watches a directory for SiLK data files and
appends those files to the final storage location where the SiLK
analysis tools (from the silk-analysis package) can process them. To
move the files from rwflowpack to rwflowappend, an rwsender-rwreceiver
pair is typically used.