yaf - Yet Another Flow sensor
YAF is Yet Another Flow sensor. It processes packet data from pcap(3) dumpfiles as generated by tcpdump(1) or via live capture from an interface using pcap(3) or an Endace DAG card into bidirectional flows, then exports those flows to IPFIX Collecting Processes or in an IPFIX-based file format. YAF's output can be used with the NetSA Aggregated Flow (NAF) toolchain.
|yaf-2.12.1-1.fc33.src [2.1 MiB]||
by Lawrence R. Rogers (2020-12-22):
* Release 2.12.1-1 Changed the templates and IEs used for SMTP DPI. The new templates use different IDs than those used by previous releases of YAF. super_mediator-1.8.0 or later is required to read this format. Currently there is no version of Analysis Pipeline that reads the SMTP DPI. First public release of YAF 2.12.x.