Trisul Application Notes

Task-focused application notes for Trisul. Each note states the problem, explains how the feature works, and gives the full procedure with checks.

All notes

ID	Title	Use it to…	Applies to
AN-001	Resolve router and interface names for NetFlow with SNMP	Show router and interface names instead of IPs and ifIndex numbers	NetFlow input
AN-002	Scale NetFlow monitoring for large enterprises	Stop routers and interfaces dropping out of NetFlow toppers	NetFlow Analyzer mode
AN-003	Control host storage growth in ISP NetFlow deployments	Keep host storage under control at an ISP	ISP deployments
AN-004	Give ISP subscribers a login to their own traffic reports	Give each subscriber a login that shows only their own traffic	ISP and MSP operators
AN-005	Get Snort, Barnyard2 and Suricata alerts into Trisul	See IDS alerts next to traffic data	Packet capture mode
AN-006	Add your own threat intel to Badfellas	Match traffic against your own IP, domain and URL indicators	Hub and probes running Badfellas
AN-007	Analyze PCAP dumps offline in their own Trisul context	Analyze a saved PCAP without mixing it into live data	Packet capture mode, probe node
AN-008	See the real client behind your web proxy with X-Forwarded-For	Attribute web traffic to the real client behind a proxy	Packet capture mode, upstream of a web proxy
AN-009	Cut Trisul storage per day by tuning flows, edges and counter groups	Reduce how much disk Trisul uses per day	Hub database; probe flow and edge settings
AN-010	Recover Trisul from a full disk and stop it filling again	Recover from a 100% full disk	Probe and hub storage, default context
AN-011	Serve the Trisul web interface over HTTPS	Serve the web UI over HTTPS with your own certificate	Hub node running WebTrisul
AN-012	Move the Trisul web interface off port 3000	Run the web UI on a port other than 3000	Hub running webtrisuld
AN-013	Add web server capacity when WebTrisul slows down under many users	Make the web UI faster for many concurrent users	Hub running WebTrisul
AN-014	Capture a core dump when the Trisul Probe crashes	Collect a core dump and stack trace after a probe crash	Probe nodes

Find a note by product mode

Mode	Notes
NetFlow Analyzer	AN-001 SNMP name resolution · AN-002 Scale for large enterprises
ISP Analytics	AN-003 Host storage growth · AN-004 Subscriber reports
NSM (packet capture, IDS)	AN-005 IDS alerts · AN-006 Custom threat intel · AN-007 Offline PCAP · AN-008 Web proxies (XFF)
All modes (administration)	AN-009 Storage tuning · AN-010 Disk full · AN-011 HTTPS · AN-012 Web port · AN-013 Web server capacity · AN-014 Core dumps

Related notes

• Storage: AN-003, AN-009 and AN-010 cover the same storage from three angles: ISP host policy, per-day tuning, and recovery from a full disk.
• Web server: AN-011, AN-012 and AN-013 all change the WebTrisul web server setup on the Hub.
• NetFlow: AN-002 ends where AN-001 starts (SNMP name resolution).
• IDS: AN-005 and AN-007 both use trisulctl_probe importpcap_ids for saved captures.