yaf与silk环境搭建

单机环境时的配置

本机环境

[root@localhost yaf]# cat /etc/redhat-release 
CentOS release 6.5 (Final)
[root@localhost yaf]# uname -a
Linux localhost.localdomain 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux

 Install prerequisites

$ yum groupinstall "Development Tools"
$ yum install libpcap libpcap-devel pcre pcre-devel glib2-devel

Groupinstall是yum的属性参数 按组安装（可以省略）

安装抓包库，perl支持库，glib2-devel此处可以根据自己的机器来定，缺什么样的库再去查找安装

Build libfixbuf:

$ tar -xvzf libfixbuf-1.4.0.tar.gz
$ cd libfixbuf-1.4.0
$ ./configure
$ make
$ make install
官网上有此fixbuf的库

http://tools.netsa.cert.org/

http://tools.netsa.cert.org/fixbuf/download.html

Build yaf:

$ tar -xvzf yaf-2.5.0.tar.gz
$ cd yaf-2.5.0
$ ./configure --enable-applabel --enable-plugins
$ make
$ make install

./configure支持应用标签，支持插件

To run yaf as a service:

$ cp etc/init.d/yaf /etc/init.d/
$ cp etc/yaf.conf /usr/local/etc/

命令中的etc是在yaf的安装目录中，如/usr/local/yaf-2.5.0l

Build SiLK:

$ tar -xvzf silk-3.8.0.tar.gz
$ cd silk-3.8.0
$ ./configure --with-libfixbuf=/usr/local/lib/pkgconfig --enable-ipv6
$ make
$ make install

./configure也可以不用写 –with-libfixbuf默认的情况下是可以找到的，如果为了确保万一那就写

./configure成功后应为

    * Configured package:           SiLK 3.8.2
    * Host type:                    i686-pc-linux-gnu
    * Source files ($top_srcdir):   .
    * Install directory:            /usr/local
    * Root of packed data tree:     /data
    * Packing logic:                via run-time plugin
    * Timezone support:             UTC
    * Default compression method:   SK_COMPMETHOD_NONE
    * IPv6 network connections:     YES
    * IPv6 flow record support:     NO
    * IPFIX collection support:     NO
    * NetFlow9 collection support:  NO (No IPFIX support)
    * Transport encryption support: YES (-lgnutls -lgcrypt -ldl -lgpg-error)
    * IPA support:                  NO
    * ZLIB support:                 YES (-lz)
    * LZO support:                  YES (-llzo2)
    * LIBPCAP support:              YES (-lpcap)
    * C-ARES support:               NO
    * ADNS support:                 NO
    * Python interpreter:           /usr/bin/python
    * Python support:               NO
    * Build analysis tools:         YES
    * Build packing tools:          YES
    * Compiler (CC):                gcc
    * Compiler flags (CFLAGS):      -I$(srcdir) -I$(top_builddir)/src/include -I$(top_srcdir)/src/include -DNDEBUG -D_ALL_SOURCE=1 -D_GNU_SOURCE=1 -D_FILE_OFFSET_BITS=64 -O3 -fno-strict-aliasing -Wall -W -Wmissing-prototypes -Wformat=2 -Wdeclaration-after-statement -Wpointer-arith
    * Linker flags (LDFLAGS):       
    * Libraries (LIBS):             -llzo2 -lz -ldl -lm

Setup SiLK

This examp