Tranalyzer - Tranalyzer2 Configuration Cheatsheet

Tutorial: Tranalyzer2 Configuration Cheatsheet

This cheatsheet summarises the most important configuration flags available for Tranalyzer2.

List of important Tranalyzer2 configuration flags

Basics

Constant	Meaning	File
`ETH_ACTIVATE`	Handling of layer 2 flows	networkHeaders.h
`IPV6_ACTIVATE`	IP version(s) to dissect	networkHeaders.h

`T2_HDRDESC_AGGR`	Aggregate repetitive headers, e.g., `vlan{2}` instead of `vlan:vlan`	networkHeaders.h
`T2_PRI_HDRDESC`	Keep track of the headers traversed	networkHeaders.h

`GRE`	Activate GRE processing	tranalyzer.h
`IPIP`	Activate IPv4/6 in IPv4/6 processing	tranalyzer.h
`L2TP`	Activate L2TP processing	tranalyzer.h
`TEREDO`	Activate Teredo processing	tranalyzer.h

`VERBOSE`	Verbose level of final report	tranalyzer.h

Packet Mode

Constant	Meaning	File
`SPKTMD_PKTNO`	Print packet number	main.h
`SPKTMD_PCNTC`	Print L7 content as characters (`-s` option)	main.h
`SPKTMD_PCNTH`	Print L7 content as hex (`-s` option)	main.h

Interface

Constant	Meaning	file
`ENABLE_IO_BUFFERING`	Input buffering (store packets in a queue)	ioBuffer.h
`HASHFACTOR`	Default multiplication factor for `HASHTABLE_BASE_SIZE`	tranalyzer.h
`HASH_CHAIN_FACTOR`	Default multiplication factor for `HASHCHAINTABLE_BASE_SIZE`	tranalyzer.h

Monitoring

Constant	Meaning	File
`PLUGIN_REPORT`	enable plugins to contribute to Tranalyzer command line end report	tranalyzer.h
`DIFF_REPORT`	Absolute/differential Tranalyzer command line USR1 report	tranalyzer.h
`MACHINE_REPORT`	Human/machine compliant report	tranalyzer.h

`MONINTTHRD`	Threaded interrupt handling: default	main.h
`MONINTBLK`	Non-threaded, block interrupts during packet processing	main.h
`MONINTPSYNC`	Synchronized print statistics	main.h
`MONINTTMPCP`	Time-base for monitoring	main.h
`MONINTTMPCP_ON`	Automatic start of monitoring	main.h
`MONINTV`	Interval (seconds) of monitoring output	main.h
`MONPROTMD`	Output protocol numbers or names	main.h

Alarm Mode

Constant	Meaning	File
`ALARM_MODE`	Only flow output if an alarm based plugin fires	tranalyzer.h
`ALARM_AND`	Logical operation of all alarm based plugins (AND/OR)	tranalyzer.h

Force Mode

Constant	Meaning	File
`FORCE_MODE`	Parameter induced flow termination, implemented by plugins	tranalyzer.h

Flow Aggregation

Constant	Meaning	File
`AGGREGATIONFLAG`	Flow aggregation	tranalyzer.h
`DSTPORTHW`	Dst port upper bound	tranalyzer.h
`DSTPORTLW`	Dst port lower bound	tranalyzer.h
`SRCPORTHW`	Src port upper bound	tranalyzer.h
`SRCPORTLW`	Src port lower bound	tranalyzer.h

Flow Timeout

Constant	Meaning	File
`FDURLIMIT`	Flow duration limitation	tranalyzer.h
`FDLSFINDEX`	Same findex for early duration limited flows	tranalyzer.h
`FLOW_TIMEOUT`	Standard flow timeout	tranalyzer.h

SCTP

Constant	Meaning	File
`SCTP_ACTIVATE`	Activate SCTP streams -> flows	tranalyzer.h
`SCTP_STATFINDEX`	Findex increments or constant for all SCTP streams in a packet	tranalyzer.h

Geolocation

Constant	Meaning	File
`CNTYCTY`	Output county and city	subnetHL.h
`SUBNET_ON`	Enable subnet functions	subnetHL.h
`SUBRNG`	IP range definition	subnetHL.h

Packet length statistics

Constant	Meaning	File
`PACKETLENGTH`	controls L2-7 length included in `packet->packetLength`	packetCapture.h
`FRGIPPKTLENVIEW`	IP header added in 2nd fragment in `packet->packetLength`	packetCapture.h

Multiple file I/O

Constant	Meaning	File
`MFPTMOUT`	Timeout for poll timing > `POLLTM`	tranalyzer.h
`RROP`	Round robin operation	tranalyzer.h