This article provides guidelines to help installing Trisul Network Anayltics in your system.

Trisul is a distributed monitoring system with a number of trisul-probe instances all reporting back to one or more trisul-hub. We first explain how you can install all components on a single box and then slowly expand to explore distributed installation.

There are three major ways to get data into Trisul. Click on each link for detailed instructions.

Live packet capture

• Configure a Port Mirror (SPAN Port), use a Network Tap, or a Linux Inline Bridge.
• Read Setup packet capture for Trisul.

Netflow from routers, switches

• Configure your routers, switch to send Netflow, SFLOW, IPFIX or other similar flow information to Trisul.
• Read Setup Netflow for Trisul.

Read PCAP dumps

• Read PCAP files dumped by a third party program like tcpdump.
• Read Process PCAP dumps with Trisul.