Settings

Configure → Settings (admins) holds the settings that apply to the whole server. Changes take effect at once.

Ingest and lookups

Setting	Default	What it does
Approve new exporters automatically	Off	Otherwise new exporters wait as pending: their templates are learned, their flows dropped
Clock skew threshold (ms)	2000	Exporter timestamps further off than this are corrected
On-demand lookups via notoolkit.com	On	WHOIS, registrant and RPKI for remote addresses and ASes. Local and private addresses are never sent
Re-classify speed limit (rows/s)	200,000	How fast re-classify rewrites history

Reverse DNS

Resolve PTR names of top remote talkers looks up the reverse DNS of the busiest remote addresses through the host’s resolver, so reverse DNS rules can name their traffic. It never runs on the ingest path: a slow resolver delays only the names. Settings: queries per second, addresses per minute, and how long to cache names and failures.

Detection

Setting	Default	What it does
Window (s)	5	Rates are averaged over this
Settle delay (s)	2	The newest seconds are left out, for late datagrams
Sample flows per attack	500	Flow records kept with each attack
Update attacks every (s)	10	How often an active attack’s record is updated
Tracked IPv4 hosts, Tracked IPv6 hosts	500,000 and 100,000	Hosts watched at once; the least recently active make room
Forget idle hosts after (s)	300
Record peaks above (Mbps / pps)	1 Mbit/s or 1,000 pps	Hosts’ per-minute peaks above this are recorded, for the tuning preview and baselines
Amplification source ports	DNS 53, NTP 123, SSDP 1900, CLDAP 389, SNMP 161, memcached 11211, chargen 19, WS-Discovery 3702, ARMS 3283, mDNS 5353, Ubiquiti 10001, DVR 37810, MS-SQL 1434, NetBIOS 137, RIPv1 520	UDP from these source ports counts toward the amplification limits
Baseline triggers (global switch)	On	Off stops every baseline trigger at once; learning continues
Learning period (days)	14	History a host needs before its baseline triggers
History (weeks)	4	Weeks of the same hour that make up a baseline
Weekly decay	0.8	Weight of each older week
Time zone	UTC	Whose hours of the week, for example America/New_York

A smaller window detects faster but reacts more to bursts. See Detection.

Mitigation

Setting	Default	What it does
Blackhole communities		The default communities (also on the BGP page)
Most bans active at once	100	Further mitigations are refused and notified (mitigation_refused)

Notifications

Base URL (for links in messages), Server name (in every subject) and the Coalescing window (default 30 seconds). See Notifications.

Login page

Note under the login form: plain text shown to everyone who opens the login page, such as a read-only demo login’s credentials.

Retention

How many days each kind of data is kept. 0 keeps it forever (except raw flows, which need at least 1 day). Shortening a retention deletes older data at once, after a confirmation. See Storage and retention for the defaults and sizes.