Python socket and struct
The script, netFlow_v5_parser.py, was modified from Brian Rak's blog post on http://blog.devicenull.org/2013/09/04/python-netflow-v5-parser.html; this was done mostly for Python 3 compatibility as well as additional NetFlow version 5 fields. The reason we choose v5 instead of v9 is because v9 is more complex as it introduces templates; therefore, it will provide a very difficult-to-grasp introduction to NetFlow. Since NetFlow version 9 is an extended format of the original NetFlow version 5, all the concepts we introduced in this section are applicable to it. Because NetFlow packets are represented in bytes over the wire, we will use the struct module included in the standard library to convert bytes into native ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access