Skip to main content

Unusual Traffic Hosts

Hosts with traffic outside the common web, mail, FTP and SSH ports, keyed by IPv4 address.

PropertyValue
GUID{AE3A1449-5663-41A5-A028-FDE61DBB7EFA}
LayerDerived
InputPackets, Flows
Key typeIPv4 address
ImplementationDerived — filter of Hosts by Apps keys not in p-0050, p-01BB, p-0019, p-006D, p-006E, p-008F, p-00DC, p-03E1, p-03E3, p-0014, p-0015, p-0016 (inverse list). Engine: trisul_probe/pcappipe/CmdDynagen.cpp
Bucket / Topper60 s / 300 s
Enabled by defaultNo (Inactive)

What it measures​

  • This is a filtered counter group. The rule is stored in the TRISUL_COUNTER_GROUP_FILTERS table: parent Hosts, filter group Apps, FilterKeyInvList p-0050,p-01BB,p-0019,p-006D,p-006E,p-008F,p-00DC,p-03E1,p-03E3,p-0014,p-0015,p-0016: ports 80, 443, 25, 109, 110, 143, 220, 993, 995, 20, 21 and 22.
  • For each packet, flow record or flow-tracker update, the probe looks at the Apps keys in it. If none of them is in the list, every Hosts update in the same packet or record is copied here. Both endpoints are copied, so clients and servers both appear.
  • The Apps key is the port the probe picked for that traffic, normally the lower of the two TCP or UDP ports.
  • The group has no meter list of its own. It uses the Hosts meter list, with the same IDs, names and topper counts.
  • The group is Inactive in a new context. To use it, enable it under Context: default → profile0 → Counter Groups (see Counter Group Settings) and restart Trisul.
  • An update must contain an Apps key to be tested. ICMP and IPsec packets carry the Apps keys icmp and ipsec0, so they count as unusual. Other IP protocols such as GRE create no Apps key and are not counted.
  • DNS (port 53), NTP and most other services are not in the list, so expect this group to be busy.

Keys​

Same keys as Hosts: one IPv4 address in dotted uppercase hex.

KeyMeaning
C0.A8.01.35192.168.1.53, an internal DNS server
0A.00.00.0F10.0.0.15, a host using RDP (port 3389)
2D.4F.13.C445.79.19.196, an external host on an uncommon port

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Each matching packet or flow updates two host keys, so Total here is about 2× the matching traffic.

Meter list​

Inherited from Hosts. A meter has data here only if it was updated in the same packet, flow record or flow-tracker update as the matching Apps key.

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes of matching traffic where the host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets of matching traffic where the host is source or destination.
4Active connsVT_RUNNING_COUNTERconns500Copied from the flow tracker's create (+1) and expire (−1) updates when the flow's Apps key matches.
5Attacker alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
6HomenetVT_RATE_COUNTERBps200Matching bytes, when the host is inside the home network.
7ExternalVT_RATE_COUNTERBps200Matching bytes, when the host is outside the home network.
8TCP SYN sentVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
9TCP SYN recvVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100Copied from Hosts for matching packets or flow records.
11Blacklist alertsVT_COUNTERalerts200Copied only if the Badfellas update arrives together with the matching traffic.
12Victim alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
13New connsVT_COUNTERconns200Copied from the flow tracker: +1 per new flow on both endpoints when the flow's Apps key matches.
14Into InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
15Outof InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
16Flow RecordsVT_COUNTERBps200Copied from Hosts: +1 per matching flow record, on both endpoints.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: