Reference
Host, AS and other pages
Every address, AS, prefix, application, country, interface and exporter has its own page, with its traffic, peers and lookups.
Every value Heimnull shows links to its own page. Each has Explore this traffic and Flow records buttons, which continue in Explore with that value as the filter.
An address, yours or remote.
- Badges and actions in the title row, including mitigating the address (operators) and its display name.
- Figures: traffic now, peak, packets, number of peers and applications.
- The traffic chart, with the learned baseline (the typical peak for each hour of the week) dashed, once the host has enough history.
- Peers, applications (with how each was identified), ports and countries.
- Detection: the hostgroup’s limits and where the host stands against them.
- Behind NAT: for a public address, the internal hosts Heimnull has seen behind it.
- For remote addresses, the registry record from NoToolkit: routed prefix, origin AS, organization, country and the abuse contact.
Display names
Section titled “Display names”Give an address a name on its host page (operators and admins), for example Mailserver. It shows beside the address everywhere: tables, flow records, menus, search and notifications.
A remote network: its name and registration country (PeeringDB, then the registry), peering policy, traffic over time, its prefixes and your hosts it talks to, and an RPKI badge for its announcements.
Prefix
Section titled “Prefix”A routed prefix and its origin AS, with RPKI validity (valid, invalid or not found), its traffic and the hosts in it.
Application, country, interface and exporter
Section titled “Application, country, interface and exporter”- Application: its traffic, your hosts using it, and the rules that label it.
- Country: its traffic and the networks in it.
- Interface: in and out traffic against capacity, and the flows-versus-SNMP accuracy chart (see Interfaces).
- Exporter: what it sends, its sampling and its health.
Lookups
Section titled “Lookups”WHOIS, registrant and RPKI details come from NoToolkit, looked up on demand and cached (a day for addresses and ASes, an hour for RPKI). Only remote addresses and AS numbers are ever sent: never an address inside your networks or private address space. The busiest remote prefixes and ASes are looked up in the background every 15 minutes, so their details are ready. Turn lookups off under Settings → Ingest and lookups; the pages then show only the offline data.