Trisul Network Analytics <br/> Developer Zone hardware https://www.trisul.org/devzone/ 2026-04-20T05:29:09+00:00 Trisul Network Analytics <br/> Developer Zone https://www.trisul.org/devzone/ https://www.trisul.org/devzone/ww.trisul.org/devzone/lib/tpl/dokuwiki/images/favicon.ico text/html 2018-05-01T21:38:21+00:00 Anonymous (anonymous@undisclosed.example.com) Configuring ERSPAN packet capture for Network Security Monitoring https://www.trisul.org/devzone/doku.php/hardware:erspan?rev=1525190901&do=diff Configuring ERSPAN packet capture for Network Security Monitoring ERSPAN stands for Encapsulated Remote Switch Port ANalayzer or just Encapsulated RSPAN. This is feature available on some of the higher end platforms like Catalyst 6500 and 7500s, Nexus, and ASR platforms. Let us see how this feature can be useful in some scenarios. text/html 2019-01-07T11:45:19+00:00 Anonymous (anonymous@undisclosed.example.com) How to redirect Netflow to Trisul across network segments using NAT https://www.trisul.org/devzone/doku.php/hardware:gatewaynetflow?rev=1546841719&do=diff How to redirect Netflow to Trisul across network segments using NAT In some customers, Trisul is often deployed on a separate segment from the production routers or routers in the DMZ. These sites often have a gateway device that be be used to access. The routers can reach the gateway to export NETFLOW but cannot reach the Trisul server directly. The picture below shows how the setup is. text/html 2023-04-10T20:06:42+00:00 Anonymous (anonymous@undisclosed.example.com) Setting up a GRE Tunnel to send Netflow to remote machine https://www.trisul.org/devzone/doku.php/hardware:gretunnel?rev=1681137402&do=diff Setting up a GRE Tunnel to send Netflow to remote machine This document explains how to setup a point to point GRE Tunnel which will be used to route Netflow packets to a remote Trisul. The gateway machine is at one end of the tunnel, the Trisul server is at the other end. All your routers can send Netflow to the Gateway machine on port 2055, or 5111. They will be send to the Trisul server through the tunnel. text/html 2019-01-11T18:16:49+00:00 Anonymous (anonymous@undisclosed.example.com) Using a Shim Tunnel to send Netflow to a remote Trisul probe https://www.trisul.org/devzone/doku.php/hardware:shimtunnel?rev=1547210809&do=diff Using a Shim Tunnel to send Netflow to a remote Trisul probe A Shim tunnel encapsulates netflow payload inside a new UDP session by inserting a shim header ahead of the netflow header which will preserve the router/switch IP address. This is an alternative method when you cannot deploy the other two methods text/html 2019-07-13T18:41:46+00:00 Anonymous (anonymous@undisclosed.example.com) When to use a SHIM tunnel https://www.trisul.org/devzone/doku.php/hardware:shimtunnelintro?rev=1563023506&do=diff When to use a SHIM tunnel Some highly secure environments do not allow general purpose tunnels like GRE or VPN. In those sites, the shim tunnel comes in handy. But the receiver needs to support detunneling. This nfshim daemon adds a 12 byte shim header before the Netflow header.