Trisul runs on Linux and does the following :

• Records stats
• Records flows
• Records raw packets
• Records alerts (** coming **)

All the information is recorded in a highly indexed form in a SQLITE3 database. 

Using Trisul and Unsniff together

Trisul communicates with Unsniff via a protocol called Trisul Remote Protocol (TRP).

Unsniff 2.0 allows you to securely connect to any number of Trisul's located at strategic points in your network. This setup allows you to remotely perform drilldown network analysis on just the portion of traffic you want without hauling large dump files across the network.

We will be launching Trisul shortly. If you are interested in trying out the Beta, contact us via the Forum.