yaf --in capture.pcap --out yaf-output --ipfix
yaf --version You should see output like: yaf (Yet Another Flowmeter) version 2.14.0 Once installed, test it on a live interface or a pcap file: yaf extractor download
Once YAF is running, you can feed its IPFIX output directly into SiLK for historical analysis, or into a SIEM for real-time alerting. yaf --in capture
sudo yum groupinstall "Development Tools" sudo yum install libpcap-devel glib2-devel libfixbuf-devel libfixbuf is critical – it’s the IPFIX library YAF uses. Step 3: Compile and Install ./configure make sudo make install To verify the installation: yaf extractor download