Skip to main content

Hosts

Traffic, connection and alert counts for every IPv4 address seen, keyed by IPv4 address.

PropertyValue
GUID{4CD742B1-C1CA-4708-BE78-0FCA2EB01A86}
LayerL3 Network
InputPackets, Flows
Key typeIPv4 address
ImplementationNative C++ — CPIIPStats (trisul_probe/sysplugs/counters/PIIPStats.cpp); also updated by PITCPStats, PINetflowMeter, PISFlowMeter, the flow tracker (stengine/XSessionGroup.cpp), the alert pipeline and Trisul Badfellas
Bucket / Topper60 s / 300 s
Enabled by defaultYes

What it measures​

  • Packets: each IPv4 packet updates two keys: the source IP (Total, Transmit, Total Packets) and the destination IP (Total, Received, Total Packets). Bytes are the packet's total length.
  • Flows: each NetFlow, IPFIX or sFlow record updates the source and destination IP the same way, using the record's byte and packet counts, and adds 1 to Flow Records. In NetFlow IPDR mode the Hosts group is not updated.
  • Home network: a key's bytes go to Homenet if that IP is inside a configured Home Network, otherwise to External. The meter describes the host itself, not the other end. The derived groups Internal Hosts and External Hosts select on these two meters.
  • Every packet or flow is counted twice in the group, once for each endpoint.
  • Options in HostCounterPolicy.xml: SampleRate (count 1 in N packets and scale up), ExternalIPOnly (skip keys inside the home network) and ShortUpdates (skip the per-packet extra counters, used in ISP deployments).

Keys​

One key per IPv4 address, in dotted uppercase hex. The UI shows the dotted decimal address. The label is the DNS name learned passively from DNS A record answers, or a label you set.

KeyMeaning
C0.A8.01.02192.168.1.2
0A.00.00.FE10.0.0.254
08.08.08.088.8.8.8 (label dns.google if seen in a DNS answer)
FF.FF.FF.FF255.255.255.255, limited broadcast destination

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Each packet or flow updates two host keys, so Total here is about 2× the link traffic.

Meter list​

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes where the host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes where the host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes where the host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets where the host is source or destination. For flows, the record's packet count.
4Active connsVT_RUNNING_COUNTERconns500+1 when the flow tracker creates a flow with this host at either end, −1 when the flow expires. Shows flows open at the end of the interval.
5Attacker alertsVT_COUNTERalerts200IDS alerts from the alert pipeline where the host is the source IP.
6HomenetVT_RATE_COUNTERBps200Same bytes as Total, counted only when this host is inside the home network.
7ExternalVT_RATE_COUNTERBps200Same bytes as Total, counted only when this host is outside the home network.
8TCP SYN sentVT_COUNTERpackets100TCP packets with SYN set and ACK clear, host is the source. Packet input only.
9TCP SYN recvVT_COUNTERpackets100TCP packets with SYN set and ACK clear, host is the destination. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100TCP SYN+ACK packets. Both the source and the destination key get +1. With NetFlow, +1 to both ends for each TCP record whose flags include SYN and ACK, only when MeterTCPConnections is enabled (default off).
11Blacklist alertsVT_COUNTERalerts200Blacklist hits from the Trisul Badfellas plugin, usually on both ends of the flow.
12Victim alertsVT_COUNTERalerts200IDS alerts from the alert pipeline where the host is the destination IP.
13New connsVT_COUNTERconns200+1 for each new flow, on both endpoints.
14Into InterfaceVT_RATE_COUNTERBps200Filled only in Interface Tracker groups (Hosts filtered by a Flow Interface). Not populated in Hosts itself.
15Outof InterfaceVT_RATE_COUNTERBps200Filled only in Interface Tracker groups, like meter 14. Not populated in Hosts itself.
16Flow RecordsVT_COUNTERBps200+1 for each NetFlow, IPFIX or sFlow record where the host is source or destination. It is a record count, despite the unit label.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: