Latest release 6.0

3-Jun-2017 Trisul-Hub 6.0.2768, Trisul-Probe 6.0.2806 Web 6.0.2010

HILITE Distributed Probe / Hub architecture

Trisul 6.0 is our largest release till now. Trisul is now not only a solution that offers powerful features out of the box, but also a platform that allows talented security teams to build their own tooling on top of it.

New packages released : Jun-3-2017. Free download from

Release details

  • New : Complete rearchitecting of Trisul as a distributed Probe+Hub model
  • New : Packages split into Trisul-Probe, Trisul-Hub, Web-Trisul
  • New : Roll out a network of probes and manage them from central location
  • New : Metrics from multiple probes can be stored as ‘layers’ in our MR DB
  • New : Fast packet retrieval from remote probe locations
  • New : CURVEMQ based security of Probe-Hub-Web domain
  • New : New concept of ‘domain’ introduced
  • New : trisulctl_hub CLI tool to administer Trisul Domain Network
  • New : trisulctl_probe CLI tool to admin the probe
  • Much easier now to create new contexts, import PCAP dumps
  • Extensive new optimized LUA JIT hooks into Trisul core engine pipelines
  • New : Powerful file reassembly you can control from LUA
  • New : Aysnc execution of LUA tasks from fast packet pipeline support
  • New : UI split into admin and user roles. (for cloud & SOC use cases)
  • New : LDAP login integration
  • Open framework for your own alert types, and resource types
  • Backend pipelines also opened up – export everything to ElasticSearch or Splunk
  • Optimizations to query and DB – can handle tens of billions of flows & stats
  • Optimizations to query and DB – can handle tens of billions of flows & stats
  • Open UI framework – write D3.js scripts that directly pull from Trisul backend DB
  • Much faster ; over 80% faster charts that span a month or more
  • Over 300+ bugs and improvements since our last release
  • Tons of improvements & bug fixes

6.0 Highlights

Distributed Probes/Hub

Deploy multiple Trisul-Probes
Management CLI tools

Comprehensive new LUA API

High perf extensibility
File extraction, TCP reassembly hooks

Older releases

10-Oct-2015 Trisul 5.5.2394, Web 5.5.1797

HILITE Threshold Band

See release notes as a blog

Release details

  • New : Threshold Band computation and alerting
  • New : New User Interface support for viewing long term metrics
  • New : Self monitoring , CPU, Memory, Disk usage
  • New : New LUA support for monitoring metrics
  • Tons of improvements & bug fixes

19-May-2015 Trisul 5.5.2355, Web 5.5.1736

HILITE Scalability

Release details

  • New : Ready to download packages for CentOS 7 and Ubuntu LTS 14.04
  • New : Distributed backend storage engine
  • New : Create a probe + storage + query architecture
  • New : Can scale from small enterprise to carrier level
  • More optimizations to frontend packet path for 20Gbps and up
  • More LUA entry points into the Trisul engine
  • New : Base Domains counter group to meter applications not CDNs
  • New : UI Dashboard builder tool
  • Improvements to TCP Reassembly engine
  • Tons of improvements & bug fixes
  • Over 2800 issues closed in our bug tracker

Existing users please upgrade now.

28-Feb-2014 Trisul 4.0.1772,Web 4.0.1241

HILITE New Flow DB & interactive visualization

Release details

  • New flow streaming DB query billions of flows interactively
  • New flow DB allows query by /16, /24 subnets
  • New UI allows you to simply enter your query instead of a form
  • New IPv6 support for flows
  • New support for non TCP and UDP flows like GRE, IPSEC, ICMP etc
  • Powerful new D3 based interactive flow viz
  • Flow viz allows you to stream results
  • New Hyperloglog based general purpose cardinality meters
  • New active flows and new flows meter per IP and per App
  • Brand new mobile friendly UI
  • Tons of improvements & bug fixes
  • Over 1500 issues closed in our bug tracker

Existing users please upgrade now.