Hands-On Network Forensics

Viewing flow records as text

We can view SiLK records using the rwcut tool:

The --num-rec switch allows us to view only a specific set of records, which in our case is the first five. Again, we have a variety of options with the rwcut tool as well. We can define the fields using the --fields switch, as follows:

The output from the SiLK set of tools is very flexible and can be delimited using the --delimited switch, as follows:

We can see that ...