Skip to main content

Email Hosts

Hosts that send or receive traffic on common mail ports (SMTP, POP and IMAP), keyed by IPv4 address.

PropertyValue
GUID{22D4082E-B8BA-40D0-A287-1F524DF8DA7B}
LayerDerived
InputPackets, Flows
Key typeIPv4 address
ImplementationDerived — filter of Hosts by Apps keys p-0019, p-006D, p-006E, p-008F, p-00DC, p-03E1, p-03E3. Engine: trisul_probe/pcappipe/CmdDynagen.cpp
Bucket / Topper60 s / 300 s
Enabled by defaultNo (Inactive)

What it measures​

  • This is a filtered counter group. The rule is stored in the TRISUL_COUNTER_GROUP_FILTERS table: parent Hosts, filter group Apps, FilterKeyList p-0019,p-006D,p-006E,p-008F,p-00DC,p-03E1,p-03E3: ports 25 (SMTP), 109 (POP2), 110 (POP3), 143 (IMAP), 220 (IMAP3), 993 (IMAPS) and 995 (POP3S).
  • For each packet, flow record or flow-tracker update, the probe looks at the Apps keys in it. If one of them is in the list, every Hosts update in the same packet or record is copied here. Both endpoints are copied, so clients and servers both appear.
  • The Apps key is the port the probe picked for that traffic, normally the lower of the two TCP or UDP ports.
  • The group has no meter list of its own. It uses the Hosts meter list, with the same IDs, names and topper counts.
  • The group is Inactive in a new context. To use it, enable it under Context: default → profile0 → Counter Groups (see Counter Group Settings) and restart Trisul.
  • Mail submission ports 465 and 587 are not in the list, so that traffic is not counted unless you add those keys.

Keys​

Same keys as Hosts: one IPv4 address in dotted uppercase hex.

KeyMeaning
C0.A8.01.19192.168.1.25, an internal mail server
C0.A8.01.0C192.168.1.12, a mail client
28.63.1A.6540.99.26.101, an external mail service

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Each matching packet or flow updates two host keys, so Total here is about 2× the matching traffic.

Meter list​

Inherited from Hosts. A meter has data here only if it was updated in the same packet, flow record or flow-tracker update as the matching Apps key.

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes of matching traffic where the host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets of matching traffic where the host is source or destination.
4Active connsVT_RUNNING_COUNTERconns500Copied from the flow tracker's create (+1) and expire (−1) updates when the flow's Apps key matches.
5Attacker alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
6HomenetVT_RATE_COUNTERBps200Matching bytes, when the host is inside the home network.
7ExternalVT_RATE_COUNTERBps200Matching bytes, when the host is outside the home network.
8TCP SYN sentVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
9TCP SYN recvVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100Copied from Hosts for matching packets or flow records.
11Blacklist alertsVT_COUNTERalerts200Copied only if the Badfellas update arrives together with the matching traffic.
12Victim alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
13New connsVT_COUNTERconns200Copied from the flow tracker: +1 per new flow on both endpoints when the flow's Apps key matches.
14Into InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
15Outof InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
16Flow RecordsVT_COUNTERBps200Copied from Hosts: +1 per matching flow record, on both endpoints.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: