Optimize for a ISP deployment
Netflow data especially at a service provider can be voluminous. Trisul by default tracks the usage of each IP (internal or external in 30 second resolution). This could result in an exponential growth of the hosts traffic tracking storage.
We recommend the following policy.
- Track all IPs in the service provider domain (the service provider customers)
- Track only the top 1000 or so external IPs (out in the internet)
- Optionally increase the bucket size to a 5 minute resolution.
Specify ISP Home Network
- Click on Add a network
- Enter the IP and Subnet mask of the home network
- Repeat for all the IP ranges belonging to the ISP
Modify host tracking policy
Next cap the default “Hosts” counter group to only store traffic statistics for the top 1000 items.
- You are shown with a counter group list
- Click on Counter Group Name in Counter group list and check the TopperTrafficOnly and Save
- In counter group list click on Hosts “Toppers” link
- Change the topper count from 50 to 1000 for the
Total meter(item 0)
Enable the Internal and External counter groups
These are built in counter groups that divide the IP’s into two separate groups
- Internal Hosts
- setup to track stats for all IPs in the home network
- External Hosts
- setup to track stats for only the top 1000 IPs on the internet (external)
You can customize these two groups further if you wish (for example to increase the top 1000 hosts in the external group to the top 5000)
- Enable the first two groups “Internal Hosts” and “External Hosts”
Restart trisul for changes to take effect.