@PACKAGE_TARNAME@.conf(5)

NAME
@PACKAGE_TARNAME@.conf - @PACKAGE_NAME@ Configuration File Format v@PACKAGE_VERSION@

DESCRIPTION
The @PACKAGE_TARNAME@.conf file...

•   follows the standard INI-style format.

•   contains configuration parameters for @PACKAGE_TARNAME@(8), a deep-packet inspection server.

•   contains configuration parameters for the Netify Cloud service (https://www.netify.ai/).

  Main
The main server options are defined within the [@PACKAGE_TARNAME@] section.

enable_sink=BOOLEAN

Uploading detection flow metadata to the Netify Cloud can be enabled or disabled by setting the enable_sink option. When enabled, detection flow metadata is JSON-encoded, compressed, and uploaded to the Netify Sink server for further analysis and reporting. A Netify Portal account is required for registration and provisioning at: https://www.netify.ai/

max_backlog_kb=INTEGER

Use max_backlog_kb to set a limit on the size of the JSON upload buffer. This is specified in kibibytes and the default is 2048 (2 MiB). In the event that a payload can not be uploaded it will be queued until either it is successfully transfered or it is pushed out of the backlog buffer by a new payload.

max_tcp_pkts=INTEGER max_udp_pkts=INTEGER

Normally these shouldn't be adjusted. The defaults have been fine tuned for performance reasons. These options control the number of packets that are examined by the DPI engine before taking a guess at the type of flow. The smaller the value the less processing overhead but the less likely enough of a conversation will be analyzed resulting in fewer detections. The larger the value, the greater processing overhead required. The default values are 10 and 8 packets respectively.

ssl_use_tlsv1=BOOLEAN

For some platforms it may be necessary to enforce the use of TLSv1. The default is false.

ssl_verify=BOOLEAN

This option disables host (SNI) and peer certificate verification. You can use this option for testing against a server with a self-signed certificate. The default is false.

json_save=BOOLEAN

Enable/disable the json_save parameter to set whether the current state is output to a JSON file. The default is false.

  DNS Hint Cache
DNS hint cache options are set within the [dns_hint_cache] section. The DNS hint cache stores DNS response records for a period of time. These hints are used when application detection fails. A cache look-up is performed and any matching hostname is used to 'hint' the application detection logic. In most cases this significantly improves application detection.

enable=BOOLEAN

Enable or disable the DNS hint cache. On non-embedded systems with more memory, it is highly recommended that this be enabled for more comprehensive application detection. The default is true.

save=persistent | volatile | disabled

Enable or disable periodic saving of the DNS hint cache. When reasonably fast storage (hard-drive, fast flash, or sufficiently large RAM disk) is available this option should be enabled. In the event of a program crash/reload, or system reboot, the DNS hint cache will be primed on start-up when set to persistent. This prevents failed application detection due to missed DNS responses. The default is: persistent

ttl=SECONDS

The number of seconds DNS hints should be cached. New hints will have their initial TTL set to this value. Existing hints will have their TTL reset to this value on a cache hit (look-up match). This value should be adjusted according to available memory and network traffic. Larger networks will generate significantly more DNS traffic. The default value is 30 minutes (1800 seconds).

  Sockets
All socket related configuration options are specified under the [socket] section. The @PACKAGE_NAME@ can be configured to listen on one or more sockets (TCP/IP socket, or UNIX-domain socket). Upon a client connection, @PACKAGE_TARNAME@(8) will pass real-time JSON-encoded flow detections. This is designed for interfacing with third-party applications. Take care to protect these sockets as there is no authentication or encryption performed. Declare these paramters as arrays with a starting index[n] of zero.

socket_path[n]=PATH

Create a UNIX-domain socket at PATH for incoming client connections.

socket_address[n]=ADDRESS

Create and bind a TCP/IP socket on ADDRESS for incoming network connections.

socket_port[n]=[SERVICE|PORT]

For TCP/IP sockets, you can specify a corresponding SERVICE or PORT. If not specified, the default TCP port 7150 is used.

  Privacy Filter
The @PACKAGE_NAME@ can be configured to obfuscate flow addresses (MAC and IP) that match rules in the [privacy_filter] section. You can match by MAC or IP address. When a match is found, the MAC and IP address will be replaced with the following bogus addresses:
 MAC: 01:02:03:04:05:06 (lower addresses) 0a:0b:0c:0d:0e:0f (upper addresses)
 IPv4: 1.2.3.1 (lower addresses) 1.2.3.2 (upper addresses)
 IPv6: 1230::1 (lower addresses) 1230::2 (upper addresses) Declare these paramters as arrays with a starting index[n] of zero.

mac[n]=MAC

Privacy filter by MAC address.

host[n]=ADDRESS

Privacy filter by IP address.

SAMPLE CONFIGURATION
The following sample configuration file contains most common options with their default values.

    # @PACKAGE_NAME@ sample configuration for version @PACKAGE_VERSION@
    [@PACKAGE_TARNAME@]
    enable_sink = false
    json_save = false
    max_backlog_kb = 2048
    max_tcp_pkts = 10
    max_udp_pkts = 8
    ssl_use_tlsv1 = false
    ssl_verify = true
    [dns_hint_cache]
    enable = true
    save = persistent
    ttl = 1800
    [socket]
    listen_address[0] = 0.0.0.0
    listen_port[0] = 2100
    listen_path[0] = /var/lib/@PACKAGE_TARNAME@/@PACKAGE_TARNAME@.sock
    [privacy_filter]
    mac[0] = 00:11:22:33:44:55
    host[0] = 192.168.0.1
    host[1] = fe80::226:c6ff::1
    [tasks]
    example-task = libexample-task.so
    [services]
    example-service = libexample-service.so

SEE ALSO
@PACKAGE_TARNAME@(8)

COPYRIGHT
Copyright (C) 2015-2019 eGloo Incorporated <http://www.egloo.ca>

LICENSE
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.