Skip to main content

Web Hosts

Hosts that send or receive HTTP or HTTPS traffic (TCP or UDP port 80 or 443), keyed by IPv4 address.

PropertyValue
GUID{EEF95297-0C8D-4673-AD6B-F4BD2345FD69}
LayerDerived
InputPackets, Flows
Key typeIPv4 address
ImplementationDerived — filter of Hosts by Apps keys p-0050, p-01BB. Engine: trisul_probe/pcappipe/CmdDynagen.cpp
Bucket / Topper60 s / 300 s
Enabled by defaultNo (Inactive)

What it measures​

  • This is a filtered counter group. The rule is stored in the TRISUL_COUNTER_GROUP_FILTERS table: parent Hosts, filter group Apps, FilterKeyList p-0050,p-01BB (ports 80 and 443).
  • For each packet, flow record or flow-tracker update, the probe looks at the Apps keys in it. If one of them is p-0050 or p-01BB, every Hosts update in the same packet or record is copied here. Both endpoints are copied, so clients and servers both appear.
  • The Apps key is the port the probe picked for that traffic, normally the lower of the two TCP or UDP ports.
  • The group has no meter list of its own. It uses the Hosts meter list, with the same IDs, names and topper counts.
  • The group is Inactive in a new context. To use it, enable it under Context: default → profile0 → Counter Groups (see Counter Group Settings) and restart Trisul.
  • UDP 443 (QUIC) also matches, because the Apps key is the port number only.

Keys​

Same keys as Hosts: one IPv4 address in dotted uppercase hex.

KeyMeaning
C0.A8.01.0C192.168.1.12, a client browsing the web
8E.FA.B7.6E142.250.183.110, a web server
0A.00.00.5010.0.0.80, an internal web server

Special keys​

KeyMeaning
SYS:GROUP_TOTALSSum of every update made to this group in the interval. Each matching packet or flow updates two host keys, so Total here is about 2× the matching traffic.

Meter list​

Inherited from Hosts. A meter has data here only if it was updated in the same packet, flow record or flow-tracker update as the matching Apps key.

IDNameTypeUnitsTopBottomDescription
0TotalVT_RATE_COUNTERBps500Bytes of matching traffic where the host is source or destination.
1ReceivedVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the destination.
2TransmitVT_RATE_COUNTERBps100Bytes of matching traffic where the host is the source.
3Total PacketsVT_RATE_COUNTERpps100Packets of matching traffic where the host is source or destination.
4Active connsVT_RUNNING_COUNTERconns500Copied from the flow tracker's create (+1) and expire (−1) updates when the flow's Apps key matches.
5Attacker alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
6HomenetVT_RATE_COUNTERBps200Matching bytes, when the host is inside the home network.
7ExternalVT_RATE_COUNTERBps200Matching bytes, when the host is outside the home network.
8TCP SYN sentVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
9TCP SYN recvVT_COUNTERpackets100Copied from Hosts for matching packets. Packet input only.
10TCP SYNACK sentVT_COUNTERpackets100Copied from Hosts for matching packets or flow records.
11Blacklist alertsVT_COUNTERalerts200Copied only if the Badfellas update arrives together with the matching traffic.
12Victim alertsVT_COUNTERalerts200Not populated by the current code. Alert updates do not arrive with an Apps key.
13New connsVT_COUNTERconns200Copied from the flow tracker: +1 per new flow on both endpoints when the flow's Apps key matches.
14Into InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
15Outof InterfaceVT_RATE_COUNTERBps200Not populated by the current code.
16Flow RecordsVT_COUNTERBps200Copied from Hosts: +1 per matching flow record, on both endpoints.
17Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
18Unused Cardinality counterVT_GAUGEUniques2020Reserved cardinality slot. Not populated.
In this page: