NAF is the NetSA Aggregated Flow toolchain, by the CERT Network Situational Awareness Group. The NAF tools create and manipulate the IPFIX-based NAF file format, designed as a common format for aggregate network flow analysis. The most important difference between aggregate and raw flows is that the NAF format splits and aggregates flows into constant-size time bins. Information about the exact start time of each flow, and flow duration, is lost.
The NAF toolchain presently consists of four tools. nafalize is the NAF normalizer and aggregator, which reads libpcap save files, packets from a live libpcap interface, Argus 2.0.6 RA format flow data, or SiLK RW flow data, or existing NAF aggregate flows, and aggregates them into time and flow key bins based upon a nafalize aggregation expression. nafilter filters existing NAF data for drilling down into NAF files. nafscii prints NAF files as whitespace-separated, columnar ASCII files for manipulation by utilities that can handle whitespace-separated text. nafload inserts NAF files into a relational database via AirDBC, the AirCERT Database Connectivity layer.
NAF requires glib 2.6.4 or later (2.8.x is OK). Build and install glib before building NAF. Note that glib is also included in many operating environments or ports collections.
NAF requires libairframe 0.6.2 or later. Build and install libairframe before building NAF.
NAF requires libfixbuf 0.4.0 or later. Build and install libfixbuf before building NAF.
nafload requires AirDBC version 0.2.0 or later. Build and install AirDBC before building NAF if nafload support is required.
The NAF applications also require the included libnaf library, which implements NAF file I/O and core flow data structures common to all applications. libnaf is included and installed with the distribution.
NAF uses a reasonably standard autotools-based build system. The customary
build procedure (
NAF does support a few non-standard configure options. First is
By default, nafalize does not build with SiLK RW input support. To
enable SiLK support, fetch SiLK 0.9.x
By default, NAF is built without AirDBC support for nafload; the default
nafload implementation is a stub. To include AirDBC support and build a
working nafload, use
In general, NAF is beta quality software. Not every reasonable combination of input and configuration has been tested. Be aware of this before using NAF in production environments. The following known issues will be addressed in future releases: