Monitoring Unique Applications for Hosts Using Cardinality Counters
Scenario
The network team wants to understand how many unique applications each host is communicating with.
Instead of looking only at the amount of traffic generated by each host, they want to measure the diversity of applications associated with each host.
The requirement is:
Show me how many unique applications each host is communicating with.
A Cardinality Counter can be used to count unique values associated with keys in an existing Counter Group.
In this example, we will add a Unique Apps cardinality meter to the Hosts Counter Group.
This configuration allows Trisul to track, for each host, the number of distinct applications observed during the selected time period.
Note: Cardinality is not a separate Counter Group. You can add up to two cardinality meters to an existing Counter Group.
oaicite:1
See this scenario in action:
How to Monitor Unique Applications for Hosts Using Cardinality Counters | Trisul
The video demonstrates how to create the Cardinality Counter, configure it to track unique applications for hosts, and view the resulting cardinality data.
What You Will Build
By the end of this walkthrough, you will have:
- A Unique Apps cardinality meter associated with the Hosts Counter Group.
- A view showing the number of unique applications observed for each host.
- A practical example of how Cardinality Counters can be used to understand traffic diversity.
When This Is Useful
Cardinality Counters are useful when you want to understand how many unique entities are associated with a key, rather than how much traffic the key generated.
For example, you can use them to:
- Identify how many unique applications a host communicates with.
- Identify how many unique hosts communicate with an application.
- Measure the diversity of destinations associated with a host.
- Identify changes in the number of unique entities over time.
- Detect unusual changes in traffic diversity.
Cardinality is particularly useful when traffic volume alone does not provide enough context.
For example, two hosts may generate a similar amount of traffic but communicate with very different numbers of applications.
1. Create the Unique Apps Cardinality Counter
We first need to define what we want to measure and which unique value should be counted.
For this example:
| Setting | Value |
|---|---|
| Counter Group | Hosts |
| Cardinality Name | Unique Apps |
| Unique Value | Applications |
Think of the configuration this way:
Counter Group = What you want to evaluate
Cardinality = What unique values you want to count
So:
Hosts + Unique Apps
means:
For each host, count the number of unique applications associated with it.
Navigation
- Log in to Trisul as an administrator.
👉 Go to Profile0 from the main sidebar, then navigate to Custom Counters → Cardinality
- Click Create New.
- Select the Hosts Counter Group.
- Configure the cardinality counter to track unique applications.
- Enter the required name and description.
- Click Create.
The Unique Apps cardinality counter is now configured for the Hosts Counter Group.
Note: Trisul supports a maximum of two cardinality counters per Counter Group.
oaicite:2
Restart the Probe to enable the configuration.
2. View Unique Applications for Hosts
Once the Cardinality Counter is enabled, Trisul begins tracking the number of unique applications associated with each host.
The resulting metric answers the question:
How many different applications did this host communicate with?
For example:
| Host | Unique Apps |
|---|---|
| 10.10.10.10 | 5 |
| 10.10.10.20 | 12 |
| 10.10.10.30 | 2 |
In this example:
- 10.10.10.10 communicated with 5 unique applications.
- 10.10.10.20 communicated with 12 unique applications.
- 10.10.10.30 communicated with 2 unique applications.
The value represents unique application participation, not the amount of traffic generated by the applications.
3. Add the Cardinality Metric to a Dashboard
The Cardinality Counter can be used as a metric when building a dashboard view of the Hosts Counter Group.
Navigation
👉 Go to Dashboards from the main sidebar and click Show All
- Open the dashboard where you want to display the cardinality information.
- Add the required Current Toppers module.
- Configure the module to use the Hosts Counter Group.
- Select the Unique Apps cardinality metric.
- Configure the required time range and topper count.
- Click Save.
The dashboard now provides a view of hosts based on the number of unique applications associated with them.
4. Analyze Host Application Diversity
Open the dashboard and view the Hosts module using the Unique Apps cardinality metric.
A host with a high cardinality value is associated with a larger number of unique applications.
A host with a low cardinality value is associated with fewer unique applications.
This provides a different perspective from traditional traffic meters such as Total, In, or Out.
For example:
Total traffic answers: How much traffic did the host generate?
Unique Apps answers: How many different applications did the host communicate with?
Cardinality therefore provides visibility into the spread or diversity of network activity, rather than simply its volume.
What This Demonstrates
This scenario demonstrates how a Cardinality Counter can be added to an existing Counter Group to measure unique entities.
The configuration used here was:
Hosts → Unique Apps → Count unique applications
This tells Trisul:
For every host, count how many unique applications are associated with it.
Unlike a traditional meter such as Total, which measures traffic volume, a Cardinality Counter measures the number of distinct values observed.
Cardinality can therefore reveal changes in traffic diversity that may not be obvious from traffic volume alone.
Cardinality vs Traffic Volume
It is useful to understand the difference between a traditional traffic meter and a Cardinality Counter.
| Measurement | Answers |
|---|---|
| Total | How much traffic was generated? |
| Packets | How many packets were observed? |
| Flows | How many flows were observed? |
| Unique Apps | How many different applications were observed? |
For example, two hosts may each generate 1 GB of traffic.
However:
- Host A may communicate with 2 applications.
- Host B may communicate with 50 applications.
Both hosts have similar traffic volume, but their traffic diversity is very different.
The Cardinality metric makes this difference visible.
Key Takeaway
A Cardinality Counter lets you measure how many unique values are associated with each key in a Counter Group.
In this example:
Hosts → Unique Apps
provides the number of distinct applications associated with each host.
This allows Trisul to show not only how much traffic a host generates, but also how diverse its application activity is.
Cardinality is therefore useful for understanding traffic diversity, identifying changes in participation, and adding behavioral context to traditional traffic metrics.