Mastering Python Networking - Second Edition

Python socket and struct

The script, netFlow_v5_parser.py, was modified from Brian Rak's blog post at http://blog.devicenull.org/2013/09/04/python-netflow-v5-parser.html. The modification was mainly for Python 3 compatibility as well as parsing additional NetFlow version 5 fields. The reason we choose NetFlow v5 instead of NetFlow v9 is that v9 is more complex and uses templates to map out the fields, making it more difficult to learn in an introductory session. However, since NetFlow version 9 is an extended format of the original NetFlow version 5, all the concepts we introduced in this section are applicable to it.

Because NetFlow packets are represented in bytes over the wire, we will use the Python struct module included in the standard ...