In recent years, the concepts of Artificial Intelligence (AI) and Machine Learning (ML)...
4.7 Collector settings
4.7.1 collector.detect.explorer_ips #
Instructs the collector to ignore the Explorer-generated traffic, which can initiate false IRP reaction to the network events (Excessive loss, blackout).
This feature is used only by the SPAN collector, instructing it to ignore the IPv4 traffic when the network address translation is used to masquerade IP addresses.- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
0 - Recommended value:
0
4.7.2 collector.export.archive_inbound #
Enable Inbound traffic distribution history.
- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
1
4.7.3 collector.export.archive_transit #
Enable Transit traffic distribution history.
Warning: may significantly increase disk consumption.
- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
1
4.7.4 collector.export.top_volume_ips #
Defines the maximum number of top hosts per prefix for which usage values are stored. Collector persists up to this number of IP address, usage tuples together with other prefix statistics being collected. When the value of the parameter is zero no such statistics will be collected.
- Possible values:
0-10 - Default value:
5
4.7.5 collector.export.ttl #
Defines the collector-gathered data lifetime (in seconds). Larger values lead to excessive database size. Aggregated data is kept for one year, disregarding this parameter.
- Possible values:
1-1000000 - Default value:
86400 - Recommended value:
1-30days
4.7.6 collector.export.volume.high.top_n #
Defines the number of top volume prefixes.
Top N prefixes will be marked for priority probing in descending order of volume. Lower values lead to small number of events for priority probing of high volume prefixes. Higher values lead to overflow of probing queue with jobs for unimportant prefixes.
- Possible values:
0-1000000 - Default value:
50 - Recommended value:
10-50
4.7.7 collector.export.volume.min #
Defines the minimum collected prefix volume (bytes). The prefix will not be exported into the IRP database if its traffic volume is less than the value of the current parameter (collector.export.volume.min) and the percentage of the traffic volume less the collector.export.volume.min_pct parameter.
Lower values will lead to a higher number of prefixes exported into the IRP database.
- Possible values:
1-2000000000 - Default value:
100000 - Recommended value:
10000-1000000
4.7.8 collector.export.volume.min_pct #
Defines the minimum prefix volume (%) for a prefix to be exported into the IRP database. The prefix will not be exported into the IRP database if its percentage of the traffic volume is less than the value of the current parameter (collector.export.volume.min_pct) and the traffic volume less than collector.export.volume.min. The percentage of the traffic volume is calculated according to the export interval (60 seconds). Lower values will lead to a higher number of prefixes exported into the IRP database.
- Possible values:
0.0001-100 - Default value:
0.01 - Recommended value:
0.01-0.1
4.7.9 collector.flow.all_outbound #
The parameter allows Irpflowd to process all outboind traffic even not listed in collector.ournets.
Enabling the feature requires peer.X.flow_agents to be properly configured for all providers to distinguish outbound direction.
- Possible values:
0 (Ournets only), 1 (All traffic) - Default value:
0
4.7.10 collector.flow.buffer.size #
Defines the buffer size (in packets) for the Flow collector (irpflowd). Higher values lead to extra memory used by the collector. Slightly increase this value if the network has traffic spikes that cause buffer overflows and packet drop in the collector.
- Possible values:
10000-1000000 - Default value:
50000 - Recommended value:
50000-500000
4.7.11 collector.flow.enabled #
Enables the Flow collector. If the parameter is enabled, Flow Collector will be used to gather network prefix data, but it is still possible to use SPAN Collector to acquire network events.
- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
1 - Recommended value:
0– for SPAN collector (see collector.span.enabled),1– for Flow collector.
4.7.12 collector.flow.export.inbound_transit.topn #
Specifies the number of largest volume transit prefixes that are exported each collector cycle for inbound optimization of transiting traffic. Refer Optimization of transiting traffic, Optimization of transiting traffic.
- Possible values:
1-10000 - Default value:
100
4.7.13 collector.flow.listen.nf #
Defines the UDP port the Flow collector will listen to, for NetFlow traffic.
- Possible values:
0-655350 disables listening for NetFlow traffic - Default value:
2055 - Recommended value:
2055
4.7.14 collector.flow.listen.sf #
Defines the UDP port the Flow collector will listen to, for sFlow traffic.
- Possible values:
0-655350 disables listening for sFlow traffic - Default value:
6343 - Recommended value:
6343
4.7.15 collector.flow.log #
Defines the file-system path to the irpflowd log file.
- Default value:
/var/log/irp/irpflowd.log
4.7.16 collector.flow.log.level #
Defines the logging level for the irpflowd service.
- Possible values:
emerg, fatal, alert, crit, error, warn, notice, info, debug, trace - Default value:
info - Recommended value:
info
4.7.17 collector.flow.process_transit_in_outbound #
Enables or disables matching of prefix traffic at network egress for inbound optimization of transiting traffic. Refer Optimization of transiting traffic, Optimization of transiting traffic.
This should be enabled only in complex network topologies where ingress prefix statistics can be incomplete.- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
0
4.7.18 collector.flow.sources #
Defines the valid NetFlow/sFlow/jFlow exporters IP addresses. Flow data coming in from other IP addresses that are not listed in this parameter will be ignored.
It is recommended to specify only trusted Flow exporters IP addresses.
It is recommended to specify only trusted Flow exporters IP addresses.
- Possible values:
list of valid IPv4/IPv6 addresses - Default value:
0.0.0.0/0 ::/0 - Recommended value:
Trusted IPv4/IPv6 flow exporter addresses
4.7.19 collector.ournets #
Mandatory if collector.span.enabled is enabledDefines the list of networks to be analyzed. Typically this is the list of prefixes advertised by your AS.
Format:
- Space-separated list of local IPv4/IPv6 prefixes that should be analyzed and optimized by the IRP.
- Absolute path to a newline-separated file containing a list of local IPv4/IPv6 prefixes that should be analyzed and optimized by the IRP.
IPv4 prefixes are treated as /24 subnets and IPv6 prefixes as /48 subnets, if netmask is not clearly specified.
The downstream clients’ networks can be indicated as well.- Possible values:
IPv4 or IPv6 prefixes
4.7.20 collector.sessions.max #
Defines the maximum number of TCP sessions inside the collector process. It can be used to minimize memory usage.
Both Flow and Span collectors use this parameter.Estimated memory usage can be calculated as follows: usage = 80MB + (collector.sessions.max*1464)
- Possible values:
10000-10000000 - Default value:
2000000 - Recommended value: Depends on available server memory and the maximum number of simultaneous sessions during peak hours.
4.7.21 collector.snmp.enhanced.sec #
Defines during what second of a minute the SNMP enhanced algorithm should run.
- Possible values:
30-58 - Default value:
45 - Recommended value:
45
4.7.22 collector.span.buffer.size #
Defines the buffer size (in packets) for the Span collector (irpspand). Higher values lead to extra memory used by the collector. Slightly increase this value if the network has traffic spikes that cause buffer overflows and packet drop in the collector.
- Possible values:
10000-5000000 - Default value:
100000 - Recommended value:
100000-5000000
4.7.23 collector.span.enabled #
Enables the Span collector. Span collector will be used to gather network prefix data, if the parameter is enabled.
- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
0 - Recommended value:
0– if no traffic analysis should be performed by the Span collector,1– if the Span collector should analyze mirrored traffic for network events and/or prefix statistics.
See also: collector.flow.enabled
4.7.24 collector.span.interfaces #
Mandatory if collector.span.enabled is enabledDefines a space-separated network interfaces list for passive packet analysis by the Span collector.
Example:
collector.span.interfaces = eth0 eth1 eth2
4.7.25 collector.span.log #
Defines the file-system path to the irpspand log file.
- Default value:
/var/log/irp/irpspand.log
4.7.26 collector.span.log.level #
Defines the logging level for the irpspand service.
- Possible values:
emerg, fatal, alert, crit, error, warn, notice, info, debug, trace - Default value:
info - Recommended value:
info
4.7.27 collector.span.min_delay #
Enables fast probing tasks queuing for prefixes with one of the following issues:
- Blackouts
- Congestion
- Excessive packet delays.
- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
0 - Recommended value:
0
4.7.28 collector.span.min_delay.probing_queue_size #
Defines the number of slots in the probing queue that can be used by the min_delay algorithm (see: collector.span.min_delay)
- Possible values:
1-200 - Default value:
50 - Recommended value:
30-200
See also: collector.span.min_delay
4.7.29 collector.span.size_from_ip_header #
When parameter is enabled packet size is determined from header of the IPv4/IPv6 packet. Otherwise, packet size is determined from link layer information (original packet size from PCAP/SNF).
Enable this when source packets are stripped before entering Noction IRP’s appliance SPAN interface.- Possible values:
0 (Disabled), 1 (Enabled) - Default value:
0
4.7.30 collector.span.threshold.blackout #
Defines the percentage of retransmitted packets in regards to the total packets number. If retransmit is higher than this value, this prefix is considered to have a blackout.
- Possible values:
1-100 - Default value:
70 - Recommended value:
70-90
4.7.31 collector.span.threshold.congestion #
Defines the percentage of retransmitted packets in regards to the total packets number. If retransmit is higher than this value, this prefix is considered to have a congestion.
- Possible values:
0-100 - Default value:
50 - Recommended value:
30-70
4.7.32 collector.span.threshold.delay #
Percentage of excessive delayed packets by the total packets number (see collector.span.threshold.excessive). If this percentage is higher than this value, we consider this prefix to have a delay.
- Possible values:
1-100 - Default value:
20 - Recommended value:
10-30
4.7.33 collector.span.threshold.excessive #
Defines the excessive RTT (%). The value is compared to the average round trip time. If RTT is higher by collector.span.threshold.excessive in % than the average RTT, then the counter of excessive delay packets is incremented.
- Possible values:
100-500 - Default value:
200 - Recommended value:
100-500
4.7.34 collector.speaking_ips #
Defines the number of speaking IPs to be stored in the database.
- Possible values:
0-1000 - Default value:
100 - Recommended value:
100