Exporters

Configure → Exporters lists every router and switch that has sent flows to Heimnull. Everyone can read it; only admins change it.

New exporters

An exporter appears the first time a datagram arrives from a new source address. It starts pending: Heimnull learns its templates, so you can see what it sends, but drops its flows until an admin approves it. To approve new exporters automatically, turn on Approve new exporters automatically under Settings.

An exporter is identified by its source address. Routers should export from a fixed address, such as a loopback.

Settings

Setting	What it does
Name	Shown everywhere instead of the address
Override rate 1:N	Use this sampling rate, whatever the router reports
Rate until detected 1:N	Use this rate until the router reports one. 0 means none
Sampling runs only on external (WAN) interfaces	When neither address is in your networks, the record’s flow direction (ingress or egress sampling) decides inbound or outbound
Sampled on both sides	The router also samples the interfaces facing your networks. Those samples are kept out of every total and used only for the rate delivered past the router, which FlowSpec escalation needs. See Juniper MX
Largest packet, bytes	A flow record averaging more bytes per packet than this has its packet count recomputed from its bytes. Linux-based routers (MikroTik) count merged TCP segments as one packet. Default 1500; 0 takes the counts as reported
NAT from session logs	Learn each session’s translation from the firewall’s session logs. See Juniper SRX
Trust AS numbers sent by the exporter	Use the AS numbers in the records. Otherwise Heimnull resolves them itself
Resolution order	Where AS numbers come from, in order: the exporter (if trusted), then Heimnull’s routed-prefix datasets
Silent after (seconds)	How long without data before the exporter shows as silent and the “exporter silent” event fires. Default 300

Sampling

The exporter shows the rate it detected and where it came from. Heimnull picks, in order:

1. the override rate, if set;
2. a rate the router sends for the specific sampler the record came from;
3. a rate the router sends for the whole exporter (in the records or in an options template);
4. the rate until detected, if set;
5. otherwise 1, with a “no sampling rate known” warning.

Bytes and packets are multiplied by the rate when they’re stored. If the configured rate and the detected one differ, the exporter warns. If a router sends its rate byte-swapped (RouterOS 6), Heimnull reads it the right way round and says so.

SNMP

Poll interfaces over SNMP reads the interface table every minute: names, aliases, descriptions, speeds, status, and the in and out octet, packet, error and discard counters.

Setting	Default
Version	v2c (community) or v3 (user, security level, auth and privacy protocols and passwords)
Port	161
Interval	60 seconds
Timeout	3000 ms

Test SNMP polls once and reports the system name, the number of interfaces and how many have 64-bit counters. Communities and passwords are stored encrypted with HN_SECRET_KEY.

Interfaces are keyed by name, so a router that renumbers its interfaces after a reboot keeps its history. Heimnull notices a reboot within 15 seconds (or when the router’s flow export restarts) and walks the interfaces again at once.

Templates and fields

Templates and fields shows every template the exporter sent: per observation domain and template ID, the fields with their names and lengths, when it was first and last seen, and a sample decoded record. Unknown fields are listed too. This is how you check exactly what a router sends.

Status

Each exporter’s status (here and on System) shows datagrams and records per second, drops, sequence loss, export lag, clock skew, the sampling rate and its source, and for packet-sampling exporters, where samples are taken: each input and output interface combination, with its role, and whether its samples count as traffic or as copies.

Routers whose clocks are off by more than 2 seconds have their timestamps corrected, and the exporter shows a warning.