Skip to main content

Long Thin Tail Hosts

HTTP traffic to host names that are not in the web popularity ranking list at all, keyed by the full HTTP Host header.

PropertyValue
GUID{BF2C028A-CDDE-4074-8AF5-A007582D820E}
LayerL7 Application
InputPackets
Key typeHTTP host name
ImplementationNative C++ — CPICGLongThinTail (trisul_badfellas/src/badfellas/PICGLongThinTail.cpp)
Bucket / Topper60 s / 300 s
Enabled by defaultYes, but needs the ranking database (see below).

What it measures​

The Badfellas plugin reads the HTTP Host header of each flow. It looks up every domain suffix of the host in the ranking database BadFellasLongTail.tch. If no suffix is found, the flow is counted here under the full host name. A host found at any rank goes to Long Fat Tail Hosts or is not counted.

  • The ranking database is built from the longtail-alexa-1m.csv.zip or badfellas-local-longtail.csv sources in Badfellas.xml. Both are disabled by default. Without the database file, nothing is counted.
  • Only plaintext HTTP carries a Host header, so TLS traffic is not counted.
  • Host names without a dot, or 60 characters or longer, are skipped.
  • Rarely visited hosts land here, so this group is useful for spotting odd destinations such as DGA or newly registered domains.

Keys​

One key is the Host header value exactly as sent by the client.

KeyMeaning
update.vendor-xyz.netHost not in the ranking list
a1b2c3d4.example.topPossible DGA host name

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval.

Meter list​

IDNameTypeUnitsTopBottomDescription
0Total TrafficVT_RATE_COUNTERBps500Flow bytes in both directions, counted after the Host header is seen.
1HitsVT_COUNTERHits5040+1 for each flow with this host name.
2Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
3Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: