Tutorial: Tranalyzer2 Configuration Cheatsheet

This cheatsheet summarises the most important configuration flags available for Tranalyzer2.

List of important Tranalyzer2 configuration flags

Basics

Constant Meaning File
ETH_ACTIVATE Handling of layer 2 flows networkHeaders.h
IPV6_ACTIVATE IP version(s) to dissect networkHeaders.h
T2_HDRDESC_AGGR Aggregate repetitive headers, e.g., vlan{2} instead of vlan:vlan networkHeaders.h
T2_PRI_HDRDESC Keep track of the headers traversed networkHeaders.h
GRE Activate GRE processing tranalyzer.h
IPIP Activate IPv4/6 in IPv4/6 processing tranalyzer.h
L2TP Activate L2TP processing tranalyzer.h
TEREDO Activate Teredo processing tranalyzer.h
VERBOSE Verbose level of final report tranalyzer.h

Packet Mode

Constant Meaning File
SPKTMD_PKTNO Print packet number main.h
SPKTMD_PCNTC Print L7 content as characters (-s option) main.h
SPKTMD_PCNTH Print L7 content as hex (-s option) main.h

Interface

Constant Meaning file
ENABLE_IO_BUFFERING Input buffering (store packets in a queue) ioBuffer.h
HASHFACTOR Default multiplication factor for HASHTABLE_BASE_SIZE tranalyzer.h
HASH_CHAIN_FACTOR Default multiplication factor for HASHCHAINTABLE_BASE_SIZE tranalyzer.h

Monitoring

Constant Meaning File
PLUGIN_REPORT enable plugins to contribute to Tranalyzer command line end report tranalyzer.h
DIFF_REPORT Absolute/differential Tranalyzer command line USR1 report tranalyzer.h
MACHINE_REPORT Human/machine compliant report tranalyzer.h
MONINTTHRD Threaded interrupt handling: default main.h
MONINTBLK Non-threaded, block interrupts during packet processing main.h
MONINTPSYNC Synchronized print statistics main.h
MONINTTMPCP Time-base for monitoring main.h
MONINTTMPCP_ON Automatic start of monitoring main.h
MONINTV Interval (seconds) of monitoring output main.h
MONPROTMD Output protocol numbers or names main.h

Alarm Mode

Constant Meaning File
ALARM_MODE Only flow output if an alarm based plugin fires tranalyzer.h
ALARM_AND Logical operation of all alarm based plugins (AND/OR) tranalyzer.h

Force Mode

Constant Meaning File
FORCE_MODE Parameter induced flow termination, implemented by plugins tranalyzer.h

Flow Aggregation

Constant Meaning File
AGGREGATIONFLAG Flow aggregation tranalyzer.h
DSTPORTHW Dst port upper bound tranalyzer.h
DSTPORTLW Dst port lower bound tranalyzer.h
SRCPORTHW Src port upper bound tranalyzer.h
SRCPORTLW Src port lower bound tranalyzer.h

Flow Timeout

Constant Meaning File
FDURLIMIT Flow duration limitation tranalyzer.h
FDLSFINDEX Same findex for early duration limited flows tranalyzer.h
FLOW_TIMEOUT Standard flow timeout tranalyzer.h

SCTP

Constant Meaning File
SCTP_ACTIVATE Activate SCTP streams -> flows tranalyzer.h
SCTP_STATFINDEX Findex increments or constant for all SCTP streams in a packet tranalyzer.h

Geolocation

Constant Meaning File
CNTYCTY Output county and city subnetHL.h
SUBNET_ON Enable subnet functions subnetHL.h
SUBRNG IP range definition subnetHL.h

Packet length statistics

Constant Meaning File
PACKETLENGTH controls L2-7 length included in packet->packetLength packetCapture.h
FRGIPPKTLENVIEW IP header added in 2nd fragment in packet->packetLength packetCapture.h

Multiple file I/O

Constant Meaning File
MFPTMOUT Timeout for poll timing > POLLTM tranalyzer.h
RROP Round robin operation tranalyzer.h