# 使用 Homebrew 安装 yaf 查看 yaf 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。 ## 安装 ```sh sudo av install brew:yaf ``` 其他安装命令: ### macOS - Homebrew (100%): ```sh brew install yaf ``` 证据: local Homebrew formula metadata ## 软件包事实 - **软件包键:** brew:yaf - **软件包管理器:** Homebrew - **软件包管理器页面:** - **版本:** 2.19.5 - **来源摘要:** Yet another flowmeter: processes packet data from pcap(3) - **主页:** - **上游文档:** - **许可证:** GPL-2.0-only - **源码归档:** - **最后更新:** 2026-08-03T22:06:22Z - **已生成:** 2026-08-04T22:13:35+00:00 ## 可执行文件 - airdaemon (cli) - filedaemon (cli) - getFlowKeyHash (cli) - yaf (cli) - yafMeta2Pcap (cli) - yafcollect (cli) - yafscii (cli) - airdaemon (别名) - filedaemon (别名) - getFlowKeyHash (别名) - yaf (别名) - yafMeta2Pcap (别名) - yafcollect (别名) - yafscii (别名) ## 依赖 - gettext - glib - libfixbuf - libtool - pcre2 ## 构建依赖 - pkgconf ## macOS 提供的库 - libpcap ## 安装行为 - post-install 钩子: 未定义 - Bottle: 可用 于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## 版本和新鲜度 - 页面生成时间: 2026-08-04 - 管理器版本: 2.19.5 - 管理器更新时间: 2026-08-03 - 本地数据: OK - 上游仓库: https://tools.netsa.cert.org/yaf/ - 信息: Release/tag comparison is only available for GitHub repositories. ## 项目历史与用法 YAF, Yet Another Flowmeter, is CERT NetSA's packet-to-flow sensor for turning live traffic or PCAP captures into bidirectional IPFIX flow records. In package-manager terms it is the flow-metering front end of a larger network-security toolchain rather than a general packet sniffer. ### 项目历史 The NetSA documentation describes YAF as the data collection component of the CERT NetSA Security Suite. Its original purpose was experimental: tracking work in the IETF IPFIX working group, especially bidirectional flow representation, archival storage formats, structured export, and deep packet inspection fields. A 2010 USENIX LISA paper by Christopher M. Inacio and Brian Trammell presented YAF as a reference implementation of an IPFIX metering and exporting process and as a platform for rapid deployment of new flow-meter capabilities. The modern NetSA site keeps both a stable 2.x documentation set and a 3.x pre-release line, showing that the tool remained maintained long after its research-prototype origins. ### 采用历史 YAF adoption is tied to operational network monitoring, especially environments that already use SiLK, super_mediator, Analysis Pipeline, Mothra, or other IPFIX-compatible collectors. Its niche is converting high-volume packet observation into compact flow records that analysts can store, query, and correlate without preserving every packet payload. ### 使用方式 Common usage is to run `yaf` against a live interface, a pcap file, or a list of captures, export IPFIX to a collector, or write an IPFIX-based file for later processing. The documentation emphasizes flow building, DPI fields for protocols such as DNS, SSL, HTTP, and SMTP, and PCAP indexing workflows for retrospective analysis. For package users, the important distinction is that YAF is not a packet-display tool like tcpdump or Wireshark. It is a sensor component that summarizes packet streams into flow data for downstream security analytics. ### 为什么软件包爱好者会关心 YAF is interesting to package nerds because it packages a research-grade IPFIX metering implementation as a Unix sensor daemon and CLI suite. It also sits at the boundary between standards work, security operations, and package-manager distribution: libpcap in, IPFIX and SiLK-style workflows out. ### 时间线 - 2006: The public YAF release history begins with the 0.1.0 series. - 2010: YAF was presented at USENIX LISA as Yet Another Flowmeter, a reference IPFIX metering and exporting implementation. - 2011: The release history records the YAF 2.0.0 line. - 2020s: The NetSA site documents YAF 2.x as stable and YAF 3.x as a pre-release line. ### Related projects - SiLK, super_mediator, Analysis Pipeline, and Mothra are the NetSA tools most directly connected to YAF output. - libpcap and tcpdump are adjacent capture-layer tools, while IPFIX collectors are the protocol-level peers that consume YAF export streams. ### 来源 - - - - ## 安全说明 没有找到 yaf 的匹配本地密钥处理 manifest。软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。 ## 源数据库详情 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** yaf - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## 相关链接 - [Terminal utility packages](https://pkg.so/zh-hans/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/zh-hans/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Database and data packages](https://pkg.so/zh-hans/database-data-tools/) - Matched database, SQL, migration, or data-store metadata. - [Homebrew utility packages](https://pkg.so/zh-hans/brew-utility-packages/) - Matched Homebrew package provider. - [glib](https://pkg.so/zh-hans/brew/glib/) - Runtime dependency declared by Homebrew. - [pcre2](https://pkg.so/zh-hans/brew/pcre2/) - Runtime dependency declared by Homebrew. - [gettext](https://pkg.so/zh-hans/brew/gettext/) - Runtime dependency declared by Homebrew. - [libtool](https://pkg.so/zh-hans/brew/libtool/) - Runtime dependency declared by Homebrew. - [pkgconf](https://pkg.so/zh-hans/brew/pkgconf/) - Build dependency declared by Homebrew. - [silk](https://pkg.so/zh-hans/brew/silk/) - Popular package that depends on this formula. - [tcpdump](https://pkg.so/zh-hans/brew/tcpdump/) - Shares pkgdb curated category or tags: cli, network-monitoring, networking, packet-capture. - [fastnetmon](https://pkg.so/zh-hans/brew/fastnetmon/) - Shares pkgdb curated category or tags: cli, ipfix, network-monitoring, networking. - [netwatch](https://pkg.so/zh-hans/brew/netwatch/) - Shares pkgdb curated category or tags: cli, network-monitoring, networking, packet-capture. - [sniffer](https://pkg.so/zh-hans/brew/sniffer/) - Shares pkgdb curated category or tags: cli, network-monitoring, networking, packet-capture. - [argus](https://pkg.so/zh-hans/brew/argus/) - Shares pkgdb curated category or tags: cli, network-monitoring, networking, packet-capture. - [daemonlogger](https://pkg.so/zh-hans/brew/daemonlogger/) - Shares pkgdb curated category or tags: cli, network-monitoring, networking, packet-capture. - [wireshark](https://pkg.so/zh-hans/brew/wireshark/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. - [libpcap](https://pkg.so/zh-hans/brew/libpcap/) - Shares pkgdb curated category or tags: cli, networking, packet-capture. ## Combined YAML source View the package source record on GitHub. [combined/yaf.yml](https://github.com/mxcl/pkgdb/blob/main/combined/yaf.yml) ## 来源 - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - cross-ecosystem install command graph