Skip to main content

External Hosts

The subset of Hosts keys that are outside your Home Networks, keyed by IPv4 address.

PropertyValue
GUID{00AA77BB-0063-11A5-8380-FEBDBABBDBEA}
LayerDerived
InputPackets, Flows
Key typeIPv4 address
ImplementationDerived — stat based (statval) group of Hosts: meter 7 (External) > 0. Engine: trisul_probe/pcappipe/StatIdValProc.cpp
Bucket / Topper60 s / 300 s
Enabled by defaultYes

What it measures​

  • This is a stat based counter group. The rule is stored in the TRISUL_COUNTER_GROUP_STATVALS table: parent Hosts, StatID 7, operator >, value 0.
  • For each packet or flow record, the probe checks every Hosts update. If an update carries meter 7 (External) with a value above 0, the whole update is copied here under the same key. Hosts sets meter 7 only when the key itself is outside every Home Network.
  • The group has no meter list of its own. It uses the Hosts meter list, with the same IDs, names and topper counts.
  • Only meters that arrive in the same update as meter 7 are copied: traffic (0–3, 7), TCP SYN counts in packet mode (8–10) and Flow Records (16). The probe writes Active conns (4), Attacker alerts (5) and Victim alerts (12) to this group directly, choosing Internal or External Hosts by the IP's home network status.
  • If you define no Home Networks, every IPv4 address lands here.

Keys​

Same keys as Hosts: one IPv4 address in dotted uppercase hex.

KeyMeaning
08.08.08.088.8.8.8
8E.FA.B7.6E142.250.183.110
68.10.84.E5104.16.132.229

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Transit traffic between two external hosts updates two keys here, so it is counted twice.

Meter list​

Inherited from Hosts.

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes where the external host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes where the external host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes where the external host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets where the external host is source or destination.
4Active connsVT_RUNNING_COUNTERconns500Written directly by the flow tracker: +1 on flow create, −1 on expiry, for each external endpoint.
5Attacker alertsVT_COUNTERalerts200Written directly at alert flush: +1 for each alert with flow information whose source IP is this host.
6HomenetVT_RATE_COUNTERBps200Always empty here: an external host never gets meter 6.
7ExternalVT_RATE_COUNTERBps200Same bytes as Total. This is the selection meter.
8TCP SYN sentVT_COUNTERpackets100Copied from Hosts. Packet input only.
9TCP SYN recvVT_COUNTERpackets100Copied from Hosts. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100Copied from Hosts.
11Blacklist alertsVT_COUNTERalerts200Copied only if the Badfellas update arrives together with the traffic update.
12Victim alertsVT_COUNTERalerts200Written directly at alert flush: +1 for each alert with flow information whose destination IP is this host.
13New connsVT_COUNTERconns200Not populated by the current code.
14Into InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
15Outof InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
16Flow RecordsVT_COUNTERBps200Copied from Hosts: +1 per flow record with this external host at either end.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: