You can set any counter group to only save meters for the top keys via the web interface A key which makes any of the topper lists (eg, Top TCP SYNS, Top Received, etc) will be considered a topper for this option. This can help reduce disk space requirements yet give you sufficient coverage. In such an environment, you may only want to store detailed statistics of say the top 5000 IPs. This represents all internet sites browsed by all customers. Some counter groups have extremely high key diversity, such as the counter group “Hosts” an ISP. You can adjust both these parameters for each counter group via the web interface. Traffic data is bucketized (averaged) over this many secondsįor those stat-ids for which we are tracking toppers, the toppers are stored every this many seconds You can also edit the number of toppers tracked 6.1.3 Data resolution Homenet Total traffic for hosts is in home networkĮxternal Total traffic for hosts is not in home networkĬlick on any counter group to see what meters are available. Stat IDĪttacker alerts _ alerts originating from this host_

Values of several meters for each Key over time.Įxample: The Hosts counter group tracks the following meters (stat-ids).

The meters available depend on the counter group.įor each Key (counter group item), Trisul tracks and stores : Each meter, known as stat-id, represents a statistic of interest over time. Trisul meters the same set of statistics for each of these keys. The hosts counter group tracks about 12 different meters The individual host within the counter group, also known as a KeyĬ0.A8.01.02 identifies the host with IP 192.168.1.8Ģ identifies Transmit Bytes in Bytes/Sec. The entities of interest are Counter Group

The following example illustrates the concept ofĪs an example, if we wanted to refer to “Transmit traffic of host 192.168.1.2” : A counter group can have millions of keys. Within the Host counters group, the IP Address 10.10.255.7 is a key. A KeyĪn instance or a member of a counter group So the Host counter group tracks 12 meters.

Trisul collects info about Total Bytes, Packets,Receive, Transmit, Num active connections, Alerts and 10 other items. A MeterĪ parameter or data point within a counter group. Trisul measures Hosts, MACs, Applications, Subnets, VLANs, and 12 other counter groups. You can create your own custom counter groups 6.1.1 Counters, meters, and keys Counter Groupīuilt-in counter groups ship with Trisul. This section attempts to briefly explain the basic concepts of counter groups, meters, and keys.

Tracks metering