Plugin Configuration

Trisul consists of two base configs – the Trisul-Probe config file and the Trisul-Hub config file. If you wish to finely control how various metrics are computed you can tweak the following Plugin configuration files.

What are plugins?
Trisul is a network analytics platform and hence most of the actual metering functionality are implemented as native plugins. Hence the name “plugin configuration”. Each plugin has a GUID, the plugin config files therefore are created with a GUID in them.

Plugin config editor

The config file that controls how IP’s are metered is called PI-01010101-125E-48D0-8AC9-A7E3AD2F60FD.xml. Use cfgedit to locate and edit these plugin config files.

Type the following command to bring up the editor.

sudo /usr/local/share/trisul-probe/cfgedit 

Then you can select the configuration to open the configuration file. Set the shell variable $EDITOR to your favorite text editor, or the tool opens the config file in nano


Usage: cfgedit [domain-name] [probe-id] [context-name]

Some examples

# to edit configs for default context 
sudo /usr/local/share/trisul-probe/cfgedit 

# to edit context nf1 on probe1
sudo /usr/local/share/trisul-probe/cfgedit domain0 probe1 context_nf1 

# to edit context firewall on domain0/probe0
sudo /usr/local/share/trisul-probe/cfgedit context_firewall

List of all available configuration files

Here is a list of all the current plugin configuration options.

Name Description
Hosts IP address based metering
Base Domains DNS Base Domains metering (rules, regexes, etc)
Netflow NETFLOW/IPFIX policy. Link to a separate reference document.
SFlow SFLOW policy.
TCP Flows TCP Flow metering, subnets, etc
UDP Proto UDP Protocol parsing and metering
TCP Proto TCP Protocol parsing and metering
App Ports Application counting, special server ports
Mac MAC layer, directional, broadcast metering etc
IP Tunnels Used for 3GPP mobility (contact us)
DNS Control DNS extraction, resource, Full Text Search, etc
Http Hosts HTTP Host header depth setting
Geo Controls Geo plugin, country and ASN metering rules
Badfellas Controls Badfellas lists, how they are refreshed, custom rules
Urlfilter URL Filter database and rules


File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-01010101-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how hosts are metered. You need to tweak this only when working with very high speed networks and you want
maximum throughput per core at the expense of some metrics.

Parameters Defaults Description
SampleRate 1 packet sampling rate. Default, every packet.
ExternalIPOnly false only meter external IPs. IPs that are not in your HOME_NETWORK
ShortUpdates false limited host updates – do not measure TotalBandwidth, IntoHomeNetwork, OutofHomeNetwork.

Base Domains

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-081336B3-5AF1-4D4F-B850-BA3CAEEB8A2C.xml

Base domains – map domain names used by popular webservices to Application Names.

Parameters Defaults Description
Rules string of regex to app names The rules section map domain regexes in Google RE2 format to application names. You can add your own rules to this list and they will be picked up when Trisul-Probe is restarted
StaticIPRules maps static IPs to applications Most useful in corporate or TELCO settings when you have a fixed mapping of IP addressess to applications. Mostly used by caches

Specifying rules

attribute k
the key to update the Base Domains counter group
attribute x
the regex in RE2 format that matches
order of matching
the first match is selected

<Rule>     <k> WHATSAPP        </k><x>  whatsapp                                         </x></Rule>
<Rule>     <k> FACEBOOK        </k><x>  (facebook|fbcdn|fb\.me)                          </x></Rule>
<Rule>     <k> YOUTUBE         </k><x>  (youtube|ytimg|googlevideo|ggpht|gvt1\.com)      </x></Rule>


File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-819CEF8E-B6DB-431B-97D0-7DB2A5EA5392.xml

See Netflow configuration file parameters The SFLOW options have the same meaning as those of the Netflow configuration.

TCP Flows

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-88384B31-883A-8383-1278-0F3A11CEEE90.xml

How TCP Sessions are metered.

Parameters Defaults Description
SubnetOnly Only count flows in this subnet.
ShortUpdates false Only count payloads > 200 bytes and dont measure payload counts.

UDP Protocol dissector

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-09809283-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how UDP protocol dissection is done.

Parameters Defaults Description
EnableAccessPoints true Allows a dynamic mapping for port based higher level protocol. Disable for very high speed network on limited hardware.

TCP based metering

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-923740FF-125E-48D0-8AC9-A7E3AD2F60FD.xml

How TCP is metered.

Parameters Defaults Description
EnableAccessPoints true Allows a dynamic mapping for port based higher level protocol. Disable for very high speed network on limited hardware.

APP Ports

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-9999CCCC-125E-48D0-8AC9-A7E3AD2F60FD.xml

Parameters Defaults Description
SampleRate 1 Only process every X packet.
ShortUpdates false Set to true to skip some metrics. If true – skips tracking home network based meters.


By default, the app ports are selected using the following formula. If TCP, the client port is the side with the initial SYN packet. Otherwise if the protocol is UDP, or if the SYN packet is missed, the lower port is treated as the server port. This section allows you to specify exact rules.

Parameters Defaults Description
ServerPorts list of ports List of ports. Eg 40000,50000~51000,8378
Subnets a single subnet A range of IP to which the above server ports are used.


File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-ABBBBBCC-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how MAC addresses are metered.

Parameters Defaults Description
SampleRate 1 Process only 1 in X packets
MeterMACPairs true Meter MAC pairs every single Source→Dest
MeterBroadcast true Meter broadcast addresess


File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-AFFFFFFF-125E-48D0-8AC9-A7E3AD2F60FD.xml

Used for Mobility tunnels.

Parameters Defaults Description
description Controls IP Tunneling Deployments
Detunnel3GPPGTPU false Contact us for details.


File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-CCCBBBB3-125E-48D0-8AC9-A7E3AD2F60FD.xml

How DNS protocol is metered.

Parameters Defaults Description
SampleRate 1 Once every X packets
CreateFTSDocument true Do you want to create a Full Text Search Document.
ExtractResources true Extract DNS Resources. Resources can be thought of as Logs
MergeCDN true If true, CDN names like akamai.. in answer records map to the original Query name
TrackBaseDomains true Enable base domains feature.
BloomFilterResetMask 2097151 2^21-1 increase this if you have a very large number of DNS responses
GenerateAlertOnError true NXDomain responses will result in a UserAlerts error

HTTP Hosts

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-D2AAD7C6-E129-4366-A2AD-A8CB9AA4C2F4.xml

How HTTP Hosts are metered.

Parameters Defaults Description
DomainDepth 0 See below, you can control how HTTP hostnames are processed

DomainDepth if you have a HTTP host like

0 indicates fulldomain
1 com