Plugin Configuration

Trisul consists of two base configs – the Trisul-Probe config file and the Trisul-Hub config file. If you wish to finely control how various metrics are computed you can tweak the following Plugin configuration files.

What are plugins?
Trisul is a network analytics platform and hence most of the actual metering functionality are implemented as native plugins. Hence the name “plugin configuration”. Each plugin has a GUID, the plugin config files therefore are created with a GUID in them.

Plugin config editor

The config file that controls how IP’s are metered is called PI-01010101-125E-48D0-8AC9-A7E3AD2F60FD.xml. This can be a little confusing. Therefore we have included a tool that lets you locate and edit plugin config files easily. The name of the tool is cfgedit

cfgedit – the plugin config file editor

Type the following command to bring up the editor.


/usr/local/share/trisul-probe/cfgedit domain0 probe0 context0

Then you can select the configuration to edit it further.

Usage


 Usage:  /usr/local/share/trisul-probe/cfgedit domain0 probe0 context0
         /usr/local/share/trisul-probe/cfgedit context0
         /usr/local/share/trisul-probe/cfgedit 

List of all available configuration files

Here is a list of all the current plugin configuration options.

Name Description
Hosts IP address based metering
Base Domains DNS Base Domains metering (rules, regexes, etc)
Netflow NETFLOW/IPFIX policy. Link to a separate reference document.
SFlow SFLOW policy.
TCP Flows TCP Flow metering, subnets, etc
UDP Proto UDP Protocol parsing and metering
TCP Proto TCP Protocol parsing and metering
App Ports Application counting, special server ports
Mac MAC layer, directional, broadcast metering etc
IP Tunnels Used for 3GPP mobility (contact us)
DNS Control DNS extraction, resource, Full Text Search, etc
Http Hosts HTTP Host header depth setting
Geo Controls Geo plugin, country and ASN metering rules
Badfellas Controls Badfellas lists, how they are refreshed, custom rules
Urlfilter URL Filter database and rules

Hosts

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-01010101-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how hosts are metered. You need to tweak this only when working with very high speed networks and you want
maximum throughput per core at the expense of some metrics.

Parameters Defaults Description
SampleRate 1 packet sampling rate. Default, every packet.
ExternalIPOnly false only meter external IPs. IPs that are not in your HOME_NETWORK
ShortUpdates false limited host updates – do not measure TotalBandwidth, IntoHomeNetwork, OutofHomeNetwork.

Base Domains

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-081336B3-5AF1-4D4F-B850-BA3CAEEB8A2C.xml

Base domains – map domain names used by popular webservices to Application Names.

Parameters Defaults Description
Rules string of regex to app names The rules section map domain regexes in Google RE2 format to application names. You can add your own rules to this list and they will be picked up when Trisul-Probe is restarted
StaticIPRules maps static IPs to applications Most useful in corporate or TELCO settings when you have a fixed mapping of IP addressess to applications. Mostly used by caches

Specifying rules

attribute k
the key to update the Base Domains counter group
attribute x
the regex in RE2 format that matches
order of matching
the first match is selected

<Rule>     <k> WHATSAPP        </k><x>  whatsapp                                         </x></Rule>
<Rule>     <k> FACEBOOK        </k><x>  (facebook|fbcdn|fb\.me)                          </x></Rule>
<Rule>     <k> YOUTUBE         </k><x>  (youtube|ytimg|googlevideo|ggpht|gvt1\.com)      </x></Rule>

SFlow

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-819CEF8E-B6DB-431B-97D0-7DB2A5EA5392.xml

See Netflow configuration file parameters The SFLOW options have the same meaning as those of the Netflow configuration.

TCP Flows

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-88384B31-883A-8383-1278-0F3A11CEEE90.xml

How TCP Sessions are metered.

Parameters Defaults Description
SubnetOnly 0.0.0.0/0 Only count flows in this subnet.
ShortUpdates false Only count payloads > 200 bytes and dont measure payload counts.

UDP Protocol dissector

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-09809283-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how UDP protocol dissection is done.

Parameters Defaults Description
EnableAccessPoints true Allows a dynamic mapping for port based higher level protocol. Disable for very high speed network on limited hardware.

TCP based metering

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-923740FF-125E-48D0-8AC9-A7E3AD2F60FD.xml

How TCP is metered.

Parameters Defaults Description
SampleRate 1 Only process every X packet.
ShortUpdates false Set to true to skip some metrics. If true – skips tracking home network based meters.

AppPolicyItem

By default, the app ports are selected using the following formula. If TCP, the client port is the side with the initial SYN packet. Otherwise if the protocol is UDP, or if the SYN packet is missed, the lower port is treated as the server port. This section allows you to specify exact rules.

Parameters Defaults Description
ServerPorts list of ports List of ports. Eg 40000,50000~51000,8378
Subnets a single subnet A range of IP to which the above server ports are used.

APP Ports

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-9999CCCC-125E-48D0-8AC9-A7E3AD2F60FD.xml

Parameters Defaults Description
SampleRate 1
ShortUpdates false

AppPolicyItem

See AppPolicyItem from above.

MAC

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-ABBBBBCC-125E-48D0-8AC9-A7E3AD2F60FD.xml

Controls how MAC addresses are metered.

Parameters Defaults Description
SampleRate 1 Process only 1 in X packets
MeterMACPairs true Meter MAC pairs every single Source→Dest
MeterBroadcast true Meter broadcast addresess

IP TUNNELS

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-AFFFFFFF-125E-48D0-8AC9-A7E3AD2F60FD.xml

Used for Mobility tunnels.

Parameters Defaults Description
description Controls IP Tunneling Deployments
Detunnel3GPPGTPU false Contact us for details.

DNS

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-CCCBBBB3-125E-48D0-8AC9-A7E3AD2F60FD.xml

How DNS protocol is metered.

Parameters Defaults Description
SampleRate 1 Once every X packets
CreateFTSDocument true Do you want to create a Full Text Search Document.
ExtractResources true Extract DNS Resources. Resources can be thought of as Logs
MergeCDN true If true, CDN names like akamai.. in answer records map to the original Query name
TrackBaseDomains true Enable base domains feature.
BloomFilterResetMask 2097151 2^21-1 increase this if you have a very large number of DNS responses
GenerateAlertOnError true NXDomain responses will result in a UserAlerts error

HTTP Hosts

File: /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-D2AAD7C6-E129-4366-A2AD-A8CB9AA4C2F4.xml

How HTTP Hosts are metered.

Parameters Defaults Description
DomainDepth 0 See below, you can control how HTTP hostnames are processed

DomainDepth if you have a HTTP host like lax25.sjv.y1.youtube.com
|0| indicates fulldomain |
|1| com |
|2| youtube.com |
|3| y1.youtube.com |