What is YAF FOR LINUX?

YAF - Yet Another Flowmeter

YAF, or Yet Another Flowmeter, is a cool tool that processes packet data from pcap dump files. You can get these files from tcpdump or even capture data live using pcap. What YAF does is turn that data into bidirectional flows and then exports those flows to IPFIX Collecting Processes or saves them in an IPFIX-based file format. If you're into flow analysis, you'll be happy to know that YAF's output works great with SiLK flow analysis tools and the NetSA Aggregated Flow (NAF) toolchain.

Features of YAF

One of the neat features of YAF is its ability to capture partial payloads. This comes in handy for things like "banner grabbing," which helps verify protocols and detect service presence. Just keep in mind that this feature is still experimental!

Why Use YAF?

You might wonder why we need another network flow event generator. Well, YAF aims to track developments in the IETF IPFIX working group, focusing on bidirectional flow representation and archival storage formats. It’s designed to work well as a flow sensor on networks where you can use standard hardware for white-box flow collection.

The YAF Toolchain

The current toolchain for YAF includes two main tools: yaf, which does the heavy lifting, and yafscii, which converts yaf output into ASCII format.

Requirements for YAF

If you want to run YAF, you’ll need some libraries:

• glib: 2.4.7 or later.


• libairframe.


• libfixbuf: version 0.7.0 or later.


• libpcap.


• If you’re using Endace DAG live input support, make sure you have libdag as well!


• You’ll need the Perl regular expression library, PCRE, which you can find at their official site.

The Build Process Made Easy!

Bulding YAF is pretty straightforward! It uses a standard autotools-based build system. Just follow these steps: run ./configure && make && make install, and it should work in most environments without a hitch!

A Note on Compatibility with Other Versions

If you're using version 0.7.0 of YAF, it won’t play nice with older versions since it no longer uses provisional information elements for reverse direction flows.

You can download YAF here!

How Download Works

Go to the Softpas website, press the 'Downloads' button, and pick the app you want to download and install—easy and fast!