# yaf を Homebrew でインストール yaf のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:yaf ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install yaf ``` 証拠: local Homebrew formula metadata ## パッケージ情報 - **パッケージキー:** brew:yaf - **パッケージマネージャ:** Homebrew - **バージョン:** 2.19.4 - **ソース概要:** Yet another flowmeter: processes packet data from pcap(3) - **ホームページ:** - **最終更新:** 2026-07-21T16:51:42Z - **生成日時:** 2026-08-03T19:37:03+00:00 ## 実行可能ファイル - airdaemon (エイリアス) - filedaemon (エイリアス) - getFlowKeyHash (エイリアス) - yaf (エイリアス) - yafMeta2Pcap (エイリアス) - yafcollect (エイリアス) - yafscii (エイリアス) ## インストール挙動 - Bottle: 利用不可 ## バージョンと鮮度 - ページ生成日: 2026-08-03 - マネージャ版: 2.19.4 ## プロジェクトの歴史と使われ方 YAF, Yet Another Flowmeter, is CERT NetSA's packet-to-flow sensor for turning live traffic or PCAP captures into bidirectional IPFIX flow records. In package-manager terms it is the flow-metering front end of a larger network-security toolchain rather than a general packet sniffer. ### プロジェクトの歴史 The NetSA documentation describes YAF as the data collection component of the CERT NetSA Security Suite. Its original purpose was experimental: tracking work in the IETF IPFIX working group, especially bidirectional flow representation, archival storage formats, structured export, and deep packet inspection fields. A 2010 USENIX LISA paper by Christopher M. Inacio and Brian Trammell presented YAF as a reference implementation of an IPFIX metering and exporting process and as a platform for rapid deployment of new flow-meter capabilities. The modern NetSA site keeps both a stable 2.x documentation set and a 3.x pre-release line, showing that the tool remained maintained long after its research-prototype origins. ### 採用の歴史 YAF adoption is tied to operational network monitoring, especially environments that already use SiLK, super_mediator, Analysis Pipeline, Mothra, or other IPFIX-compatible collectors. Its niche is converting high-volume packet observation into compact flow records that analysts can store, query, and correlate without preserving every packet payload. ### 使われ方 Common usage is to run `yaf` against a live interface, a pcap file, or a list of captures, export IPFIX to a collector, or write an IPFIX-based file for later processing. The documentation emphasizes flow building, DPI fields for protocols such as DNS, SSL, HTTP, and SMTP, and PCAP indexing workflows for retrospective analysis. For package users, the important distinction is that YAF is not a packet-display tool like tcpdump or Wireshark. It is a sensor component that summarizes packet streams into flow data for downstream security analytics. ### パッケージ好きにとっての重要性 YAF is interesting to package nerds because it packages a research-grade IPFIX metering implementation as a Unix sensor daemon and CLI suite. It also sits at the boundary between standards work, security operations, and package-manager distribution: libpcap in, IPFIX and SiLK-style workflows out. ### タイムライン - 2006: The public YAF release history begins with the 0.1.0 series. - 2010: YAF was presented at USENIX LISA as Yet Another Flowmeter, a reference IPFIX metering and exporting implementation. - 2011: The release history records the YAF 2.0.0 line. - 2020s: The NetSA site documents YAF 2.x as stable and YAF 3.x as a pre-release line. ### Related projects - SiLK, super_mediator, Analysis Pipeline, and Mothra are the NetSA tools most directly connected to YAF output. - libpcap and tcpdump are adjacent capture-layer tools, while IPFIX collectors are the protocol-level peers that consume YAF export streams. ### ソース - - - - ## セキュリティノート yaf に一致するローカルシークレット処理マニフェストは見つかりませんでした。将来の対応で安定したパッケージ URL を使えるよう、Nucleus パッケージメタデータはここに公開されています。 ## Combined YAML source View the package source record on GitHub. [combined/yaf.yml](https://github.com/mxcl/pkgdb/blob/main/combined/yaf.yml) ## ソース - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - cross-ecosystem install command graph