Reference
License states
The license states Heimnull can be in (trial, active, grace and Free), what each allows, and what moves it from one to another.
Configure → License shows the state, the tier in force, the metered limit, whether mitigation is allowed, the last check-in and the traffic of the last 24 hours. For buying, entering and moving keys, see Licensing.
States
Section titled “States”| State | When | Heimnull runs |
|---|---|---|
| Trial | No key has ever been entered, within 30 days of the installation’s first start | Unlimited, with mitigation. A banner shows the days left and what Free mode will be |
| Active | A key whose license is active, checked in within the last check-in interval plus an hour | At the license’s tier |
| Grace | An active license that hasn’t checked in since then, within 30 days of the last good check-in | At the license’s tier, with a banner: the server hasn’t been reachable since…, Free mode from…, allow HTTPS to license.heimnull.com |
| Free | The trial ended without a key; the license expired, was suspended or revoked; or 30 days passed without a check-in | 500 Mbit/s, no mitigation, with a banner giving the reason and what to do |
- Once a key has been entered, the trial is over: a lapsed license goes to Free, never back to the trial.
- In Free mode with a stored key, Heimnull keeps checking in, so a renewed or reactivated license comes back by itself.
- Nothing stored is ever lost in any state.
| Tier | Metered limit | Mitigation |
|---|---|---|
| Free | 500 Mbit/s | No |
| 1 Gbps | 1 Gbit/s | Yes |
| 10 Gbps | 10 Gbit/s | Yes |
| Unlimited | None | Yes |
Metering
Section titled “Metering”The metered rate is the higher of the 2-hour averages of clean inbound and outbound traffic. Clean means without the traffic of active attacks, and without copies from both-sides sampling. Traffic with no inbound or outbound side counts in both directions. The minutes are kept in the database, so a restart loses no history; minutes when Heimnull was down count as zero.
Over the limit, analytics keep a random share of each direction’s clean records sized to the limit, so totals read about the licensed rate and proportions stay true. Detection, mitigation and reverse DNS still get every record, and the records of active attacks are always stored. Every page shows a banner with the 2-hour average and the limit.
Without mitigation
Section titled “Without mitigation”In Free mode (or a tier without mitigation):
- detection and notifications work as usual;
- detected attacks get no blackholes or FlowSpec rules;
- mitigations already announced are withdrawn;
- manual mitigation is hidden in the console and refused by the API (HTTP 402);
- the Mitigations and BGP pages say why.
Check-ins
Section titled “Check-ins”| When | |
|---|---|
| Every 4 hours | The interval the license server sets (normally 4 hours) |
| Every 15 minutes | While check-ins are failing |
| At once | When a key is entered, or an admin presses Check now |
A check-in’s reply is a lease signed by the license server. Heimnull accepts it only if the signature verifies with a key built into Heimnull and the reply repeats the random value Heimnull sent. Anything else (no answer, an error, a bad signature) counts as a failed check-in and changes nothing stored. Only a signed reply can suspend, revoke or end a license.
A key that’s already bound to as many installations as it allows is refused when entered, with a message saying so. What a check-in and an installation report send: see Licensing.