4.7 Collector settings

4.7.1 collector.detect.explorer_ips #

Instructs the collector to ignore the Explorer-generated traffic, which can initiate false IRP reaction to the network events (Excessive loss, blackout).

This feature is used only by the SPAN collector, instructing it to ignore the IPv4 traffic when the network address translation is used to masquerade IP addresses.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 0
Recommended value: 0

4.7.2 collector.export.archive_inbound #

Enable Inbound traffic distribution history.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 1

4.7.3 collector.export.archive_transit #

Enable Transit traffic distribution history.

Warning: may significantly increase disk consumption.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 1

4.7.4 collector.export.top_volume_ips #

Defines the maximum number of top hosts per prefix for which usage values are stored. Collector persists up to this number of IP address, usage tuples together with other prefix statistics being collected. When the value of the parameter is zero no such statistics will be collected.

Possible values: 0-10
Default value: 5

4.7.5 collector.export.ttl #

Defines the collector-gathered data lifetime (in seconds). Larger values lead to excessive database size. Aggregated data is kept for one year, disregarding this parameter.

Possible values: 1-1000000
Default value: 86400
Recommended value: 1-30days

4.7.6 collector.export.volume.high.top_n #

Defines the number of top volume prefixes.

Top N prefixes will be marked for priority probing in descending order of volume. Lower values lead to small number of events for priority probing of high volume prefixes. Higher values lead to overflow of probing queue with jobs for unimportant prefixes.

Possible values: 0-1000000
Default value: 50
Recommended value: 10-50

4.7.7 collector.export.volume.min #

Defines the minimum collected prefix volume (bytes). The prefix will not be exported into the IRP database if its traffic volume is less than the value of the current parameter (collector.export.volume.min) and the percentage of the traffic volume less the collector.export.volume.min_pct parameter.

Lower values will lead to a higher number of prefixes exported into the IRP database.

Possible values: 1-2000000000
Default value: 100000
Recommended value: 10000-1000000

4.7.8 collector.export.volume.min_pct #

Defines the minimum prefix volume (%) for a prefix to be exported into the IRP database. The prefix will not be exported into the IRP database if its percentage of the traffic volume is less than the value of the current parameter (collector.export.volume.min_pct) and the traffic volume less than collector.export.volume.min. The percentage of the traffic volume is calculated according to the export interval (60 seconds). Lower values will lead to a higher number of prefixes exported into the IRP database.

Possible values: 0.0001-100
Default value: 0.01
Recommended value: 0.01-0.1

4.7.9 collector.flow.all_outbound #

The parameter allows Irpflowd to process all outboind traffic even not listed in collector.ournets.

Enabling the feature requires peer.X.flow_agents to be properly configured for all providers to distinguish outbound direction.

Possible values: 0 (Ournets only), 1 (All traffic)
Default value: 0

4.7.10 collector.flow.buffer.size #

Defines the buffer size (in packets) for the Flow collector (irpflowd). Higher values lead to extra memory used by the collector. Slightly increase this value if the network has traffic spikes that cause buffer overflows and packet drop in the collector.

Possible values: 10000-1000000
Default value: 50000
Recommended value: 50000-500000

4.7.11 collector.flow.enabled #

Enables the Flow collector. If the parameter is enabled, Flow Collector will be used to gather network prefix data, but it is still possible to use SPAN Collector to acquire network events.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 1
Recommended value: 0 – for SPAN collector (see collector.span.enabled), 1 – for Flow collector.

4.7.12 collector.flow.export.inbound_transit.topn #

Specifies the number of largest volume transit prefixes that are exported each collector cycle for inbound optimization of transiting traffic. Refer Optimization of transiting traffic, Optimization of transiting traffic.

Possible values: 1-10000
Default value: 100

4.7.13 collector.flow.listen.nf #

Defines the UDP port the Flow collector will listen to, for NetFlow traffic.

Possible values: 0-65535 0 disables listening for NetFlow traffic
Default value: 2055

4.7.14 collector.flow.listen.sf #

Defines the UDP port the Flow collector will listen to, for sFlow traffic.

Possible values: 0-65535 0 disables listening for sFlow traffic
Default value: 6343

4.7.15 collector.flow.log #

Defines the file-system path to the irpflowd log file.

Default value: /var/log/irp/irpflowd.log

4.7.16 collector.flow.log.level #

Defines the logging level for the irpflowd service.

Possible values: emerg, fatal, alert, crit, error, warn, notice, info, debug, trace
Default value: info
Recommended value: info

4.7.17 collector.flow.process_transit_in_outbound #

Enables or disables matching of prefix traffic at network egress for inbound optimization of transiting traffic. Refer Optimization of transiting traffic, Optimization of transiting traffic.

This should be enabled only in complex network topologies where ingress prefix statistics can be incomplete.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 0

4.7.18 collector.flow.sources #

Defines the valid NetFlow/sFlow/jFlow exporters IP addresses. Flow data coming in from other IP addresses that are not listed in this parameter will be ignored.
It is recommended to specify only trusted Flow exporters IP addresses.

Possible values: list of valid IPv4/IPv6 addresses
Default value: 0.0.0.0/0 ::/0
Recommended value: Trusted IPv4/IPv6 flow exporter addresses

4.7.19 collector.flow.tcp_ports.limit #

TCP port number cap.

Parameter defines the number of TCP ports collected per each outbound IP address.

The parameter is used by Irpflowd to limit the number of ports collected within a one minute interval.
It is also used by Explorer to limit the number of TCP ports utilized for sending probes to a particular IP address.

1. Possible values: 1-50
2. Default value: 5

4.7.20 collector.flow.tcp_ports.list #

TCP port number list.

Defines a list of monitored TCP ports used by an outbound IP address, which are collected when collector.flow.tcp_ports.mode is set to “Collect ports in list”.

1. Possible values: list of TCP port numbers (1-65535)

4.7.21 collector.flow.tcp_ports.max #

TCP port range end.

Defines the end of the monitored TCP port range used by an outbound IP address, collected when collector.flow.tcp_ports.mode is set to “Collect ports in range”.

1. Possible values: list of TCP port numbers (1-65535)
2. Default value: 3000

4.7.22 collector.flow.tcp_ports.min #

TCP port range start.

Defines the start of the monitored TCP port range used by an outbound IP address, collected when collector.flow.tcp_ports.mode is set to “Collect ports in range”.

1. Possible values: list of TCP port numbers (1-65535)
2. Default value: 1

4.7.23 collector.flow.tcp_ports.mode #

TCP port collection mode.

Defines the collection mode of TCP ports, used by an outbound IP address.
Collected ports are treated as service ports open for remote connections and available for measuring performance metrics using TCP CONNECT.

0 Do not collect Disables TCP port collection
1 Collect ports in range Remote TCP ports within the range between collector.flow.tcp_ports.min and collector.flow.tcp_ports.max
2 Collect ports in list Remote TCP port present in collector.flow.tcp_ports.list
3 Lesser port number Select the outbound port number if it is smaller than the number chosen by the inbound IP address.

1. Possible values: 0, 1, 2, 3
2. Default value: 0

4.7.24 collector.ournets #

Mandatory if collector.span.enabled is enabled

Defines the list of networks to be analyzed. Typically this is the list of prefixes advertised by your AS.

Format:

Space-separated list of local IPv4/IPv6 prefixes that should be analyzed and optimized by the IRP.
Absolute path to a newline-separated file containing a list of local IPv4/IPv6 prefixes that should be analyzed and optimized by the IRP.

IPv4 prefixes are treated as /24 subnets and IPv6 prefixes as /48 subnets, if netmask is not clearly specified.

The downstream clients’ networks can be indicated as well.

Possible values: IPv4 or IPv6 prefixes

4.7.25 collector.sessions.max #

Defines the maximum number of TCP sessions inside the collector process. It can be used to minimize memory usage.

Both Flow and Span collectors use this parameter.

Estimated memory usage can be calculated as follows: usage = 80MB + (collector.sessions.max*1464)

Possible values: 10000-10000000
Default value: 2000000
Recommended value: Depends on available server memory and the maximum number of simultaneous sessions during peak hours.

4.7.26 collector.snmp.enhanced.sec #

Defines during what second of a minute the SNMP enhanced algorithm should run.

Possible values: 30-58
Default value: 45
Recommended value: 45

4.7.27 collector.span.buffer.size #

Defines the buffer size (in packets) for the Span collector (irpspand). Higher values lead to extra memory used by the collector. Slightly increase this value if the network has traffic spikes that cause buffer overflows and packet drop in the collector.

Possible values: 10000-5000000
Default value: 100000
Recommended value: 100000-5000000

4.7.28 collector.span.enabled #

Enables the Span collector. Span collector will be used to gather network prefix data, if the parameter is enabled.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 0
Recommended value: 0 – if no traffic analysis should be performed by the Span collector, 1 – if the Span collector should analyze mirrored traffic for network events and/or prefix statistics.

4.7.29 collector.span.interfaces #

Mandatory if collector.span.enabled is enabled

Defines a space-separated network interfaces list for passive packet analysis by the Span collector.

Example:

collector.span.interfaces   = eth0 eth1 eth2

4.7.30 collector.span.log #

Defines the file-system path to the irpspand log file.

Default value: /var/log/irp/irpspand.log

4.7.31 collector.span.log.level #

Defines the logging level for the irpspand service.

Possible values: emerg, fatal, alert, crit, error, warn, notice, info, debug, trace
Default value: info
Recommended value: info

4.7.32 collector.span.min_delay #

Enables fast probing tasks queuing for prefixes with one of the following issues:

Blackouts
Congestion
Excessive packet delays.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 0
Recommended value: 0

4.7.33 collector.span.min_delay.probing_queue_size #

Defines the number of slots in the probing queue that can be used by the min_delay algorithm (see: collector.span.min_delay)

Possible values: 1-200
Default value: 50
Recommended value: 30-200

4.7.34 collector.span.size_from_ip_header #

When parameter is enabled packet size is determined from header of the IPv4/IPv6 packet. Otherwise, packet size is determined from link layer information (original packet size from PCAP/SNF).

Enable this when source packets are stripped before entering Noction IRP’s appliance SPAN interface.

Possible values: 0 (Disabled), 1 (Enabled)
Default value: 0

4.7.35 collector.span.threshold.blackout #

Defines the percentage of retransmitted packets in regards to the total packets number. If retransmit is higher than this value, this prefix is considered to have a blackout.

Possible values: 1-100
Default value: 70
Recommended value: 70-90

4.7.36 collector.span.threshold.congestion #

Defines the percentage of retransmitted packets in regards to the total packets number. If retransmit is higher than this value, this prefix is considered to have a congestion.

Possible values: 0-100
Default value: 50
Recommended value: 30-70

4.7.37 collector.span.threshold.delay #

Percentage of excessive delayed packets by the total packets number (see collector.span.threshold.excessive). If this percentage is higher than this value, we consider this prefix to have a delay.

Possible values: 1-100
Default value: 20
Recommended value: 10-30

4.7.38 collector.span.threshold.excessive #

Defines the excessive RTT (%). The value is compared to the average round trip time. If RTT is higher by collector.span.threshold.excessive in % than the average RTT, then the counter of excessive delay packets is incremented.

Possible values: 100-500
Default value: 200
Recommended value: 100-500

4.7.39 collector.speaking_ips #

Defines the number of speaking IPs to be stored in the database.

Possible values: 0-1000
Default value: 100
Recommended value: 100