Skip to main content

Internal Hosts

The subset of Hosts keys that are inside your Home Networks, keyed by IPv4 address.

PropertyValue
GUID{889900CC-0063-11A5-8380-FEBDBABBDBEA}
LayerDerived
InputPackets, Flows
Key typeIPv4 address
ImplementationDerived — stat based (statval) group of Hosts: meter 6 (Homenet) > 0. Engine: trisul_probe/pcappipe/StatIdValProc.cpp
Bucket / Topper60 s / 300 s
Enabled by defaultYes

What it measures​

  • This is a stat based counter group. The rule is stored in the TRISUL_COUNTER_GROUP_STATVALS table: parent Hosts, StatID 6, operator >, value 0.
  • For each packet or flow record, the probe checks every Hosts update. If an update carries meter 6 (Homenet) with a value above 0, the whole update is copied here under the same key. Hosts sets meter 6 only when the key itself is inside a Home Network, so this group holds home hosts only.
  • The group has no meter list of its own. It uses the Hosts meter list, with the same IDs, names and topper counts.
  • Only meters that arrive in the same update as meter 6 are copied: traffic (0–3, 6), TCP SYN counts in packet mode (8–10) and Flow Records (16). The probe writes Active conns (4), Attacker alerts (5) and Victim alerts (12) to this group directly, choosing Internal or External Hosts by the IP's home network status.
  • If you define no Home Networks, this group stays empty.

Keys​

Same keys as Hosts: one IPv4 address in dotted uppercase hex.

KeyMeaning
C0.A8.01.02192.168.1.2
0A.01.14.0510.1.20.5
AC.10.00.0A172.16.0.10

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. A packet between two home hosts updates two keys here, so internal traffic is counted twice.

Meter list​

Inherited from Hosts.

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes where the home host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes where the home host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes where the home host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets where the home host is source or destination.
4Active connsVT_RUNNING_COUNTERconns500Written directly by the flow tracker: +1 on flow create, −1 on expiry, for each home endpoint.
5Attacker alertsVT_COUNTERalerts200Written directly at alert flush: +1 for each alert with flow information whose source IP is this host.
6HomenetVT_RATE_COUNTERBps200Same bytes as Total. This is the selection meter.
7ExternalVT_RATE_COUNTERBps200Always empty here: a home host never gets meter 7.
8TCP SYN sentVT_COUNTERpackets100Copied from Hosts. Packet input only.
9TCP SYN recvVT_COUNTERpackets100Copied from Hosts. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100Copied from Hosts.
11Blacklist alertsVT_COUNTERalerts200Copied only if the Badfellas update arrives together with the traffic update.
12Victim alertsVT_COUNTERalerts200Written directly at alert flush: +1 for each alert with flow information whose destination IP is this host.
13New connsVT_COUNTERconns200Not populated by the current code.
14Into InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
15Outof InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
16Flow RecordsVT_COUNTERBps200Copied from Hosts: +1 per flow record with this home host at either end.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: