Release notes

Releases are numbered vMAJOR.MINOR.PATCH: MAJOR when an upgrade needs more than the usual commands, MINOR for features, PATCH for fixes. The System page shows the notes of any newer release. To upgrade, see Upgrading.

v3.1.1

2026-10-19. RouterOS sampling read correctly.

• Byte-swapped sampling rates are read correctly. RouterOS 6 sends its sampling rate with the bytes in the wrong order: 1 in 10 arrives as more than 160 million, so a few packets to the router showed as gigabits on an idle link. Such values are now read the right way round, counted per exporter, and the exporter’s page says so. We still recommend turning packet sampling off on RouterOS 6: see MikroTik.
• RouterOS rounds its packet sampling ratio down: an interval of 5 and a space of 49 (1 in 10.8) is reported as 10, so traffic reads about 7% low. For an exact rate, set the interval to 1 and the space to N−1.
• Hours already stored keep the totals they were stored with.

v3.1.0

2026-10-18. A support file for remote troubleshooting.

• System → Generate support file (admins) downloads a zip with what someone helping you needs: the System page’s state, exporters and their templates, the configuration without secrets, recent events, attacks, mitigations and audit log, logs, ClickHouse’s errors, the last hour per interface as flows and SNMP saw it, and optionally recent flow records and a 10-second capture of the routers’ export packets. Passwords, communities, tokens and keys are never in it. See Support file.
• Install commands run as root (sudo …), with .env written inside root’s shell. From an ordinary account, the old commands couldn’t write .env into /opt/heimnull.

v3.0.2

2026-10-18. docker-compose.yml carries no comments. Nothing it does changes; ClickHouse restarts once (a few seconds) on the next docker compose up -d.

v3.0.1

2026-10-18. Clean images, replacing v3.0.0 (withdrawn): the published images carry only the amd64 and arm64 images. A server pinned to v3.0.0 changes HN_VERSION to v3.0.1 or v3.

v3.0.0

2026-10-18. Images from Heimnull’s public registry.

• Images are published as registry.heimnull.com/heimnull, and docker-compose.yml downloads from https://registry.heimnull.com/docker-compose.yml. The update check reads registry.heimnull.com too: allow outbound HTTPS to it.
• Installations without a key report themselves to license.heimnull.com every 4 hours, so active installations can be counted. See what’s sent.

v2.1.0

2026-10-18. A trial and Free mode.

• No key needed to run. A new installation runs a 30-day trial with every feature, then continues in Free mode: 500 Mbit/s of analytics, attacks detected and notified, no FlowSpec or blackholes.
• A license that lapses drops to Free mode instead of stopping Heimnull: expired, suspended, revoked, or 30 days without reaching the license server. A renewed license comes back at the next check-in.
• Banners for the trial, Free mode and why, the grace period, and going over the limit.
• Without mitigation, detected attacks get no mitigations, live ones are withdrawn, and manual mitigation is turned off.

v2.0.0

2026-10-17. Licensing: license keys with 1 Gbps, 10 Gbps and Unlimited tiers, checked with license.heimnull.com every 4 hours, metered on the 2-hour average of clean traffic. Over the licensed rate, analytics show a share of the traffic sized to the limit; detection and mitigation still see all of it. (v2.1.0 replaced this release’s lockout without a key with the trial and Free mode.)

v1.6.2

2026-10-17. Leftovers of the removed threat feeds: the footer credit and the System page’s dataset list.

v1.6.1

2026-10-17. Routed prefixes and origin ASes come from NoToolkit’s own BGP collectors instead of CAIDA’s prefix2as, with the same detail. Microsoft 365 addresses load again.

v1.6.0

2026-10-17. Threat feeds and MaxMind removed.

• Threat tracking is gone: the Threats page, Live’s threat panel, the host page’s threat lists, the Threat column and filters, and the “contact with a listed host” notification.
• MaxMind GeoLite2 is gone: countries come from DB-IP Lite.
• PeeringDB isn’t bundled in the image any more: each server downloads it.
• Configuration exports from earlier releases still import.

v1.5.0

2026-10-17. Applications keep the protocol underneath.

• Traffic named by an address or rule keeps the protocol it uses: “QUIC (YouTube)”, “HTTPS (YouTube)”. app QUIC finds all QUIC, YouTube’s included; app YouTube finds YouTube over every protocol; service QUIC the protocol alone. Flow records and CSV exports have a service column.
• “Rows dropped” no longer overstates losses when ClickHouse falls behind.
• Load tested to 300,000 records a second stored without loss.
• During the upgrade, ClickHouse fills in the protocol for stored flows in the background: expect extra disk and CPU activity for a while.

v1.4.0

2026-10-15. The attack page shows the target’s display name; Live’s top lists open the full list in Explore; Planning’s transit view measures against each interface’s subscribed rate or port speed (the price fields are gone); 3CX’s tunnel is classified.

v1.3.1

2026-10-15. Planning: peering candidates no longer show the AS number twice.

v1.3.0

2026-10-14. Planning, health alerts and update notices.

• Planning: capacity forecasts and the transit and peering view. See Planning.
• Health alerts about Heimnull itself: disk, ClickHouse memory and merges, outdated configuration, SNMP failing.
• The server’s name in every notification subject.
• Update notices on the System page.
• Install checks: env-template warns about a CPU without AVX2, too little memory or too few CPUs, and Docker Desktop.
• Router reboots are picked up in seconds, and interfaces walked again at once.

v1.2.8

2026-10-14. On a Juniper SRX, uploads no longer count as WAN inbound on the Interfaces page. The “Busiest hours” chart is gone from the Interfaces page.

v1.2.7

2026-10-14. ClickHouse keeps its full memory limit on smaller servers, and the System page names a ClickHouse running an older configuration. Download docker-compose.yml again when upgrading.

v1.2.6

2026-10-14. Ingest alerts report at most every 10 minutes, with what failed, and “recovered” only after 10 minutes clear.

v1.2.5

2026-10-13. Live keeps its filter when you drill down; the query builder can filter unidentified traffic.

v1.2.4, v1.2.3 and v1.2.2

2026-10-13. ClickHouse no longer runs out of memory merging its own internal logs on smaller servers: they’re off, and their tables are dropped. Its configuration now takes effect on upgrade. Download docker-compose.yml again when upgrading.

v1.2.1

2026-10-13. A mitigation says why a session wasn’t sent a route (the session’s state, or a family the router didn’t negotiate), and the BGP page flags families the router lacks.

v1.2.0

2026-10-12. More notification channels: Slack (and Mattermost), Microsoft Teams, ntfy, and signed JSON webhooks. Many fixes to escalation, SNMP after reboots, Live, NAT session logs and classification. Stops and upgrades no longer hang for 60 seconds. Download docker-compose.yml again, and on existing servers, make .env readable by root only: sudo chmod 600 /opt/heimnull/.env.

v1.1.0

2026-10-12. Escalation on transit congestion: a FlowSpec mitigation escalates to a blackhole when a transit link the attack arrives on stays full. See Mitigation.

v1.0.2

2026-10-11. US spelling throughout. A stopped re-classify job’s state is now canceled.

v1.0.1

2026-10-11. WHOIS, registrant and RPKI lookups use NoToolkit’s new API.

v1.0.0

2026-10-11. The first numbered release: NetFlow v9, IPFIX and sFlow collection; enrichment and application classification; Live, Explore and the entity pages; per-hostgroup detection with flex rules, baselines and carpet bombing; blackholes and FlowSpec with escalation, dry runs, a cap and an emergency withdraw-all; email and Telegram notifications; roles, API tokens, an audit log, and configuration export and import.