Help

MetaFlows

Physical Address	4295 Gesner ST STE 1C, San Diego, CA, 92117
Web Address	www.MetaFlows.com [1]
Email
Sales	sales@metaflows.com
Support	support@metaflows.com
Media	media@metaflows.com
Phone/Fax
Phone	1-877-664-7774
Phone	1-408-457-1895
Fax	1-877-539-7778

MetaFlows, Inc. is a California corporation founded in 2007 by Livio Ricciulli, with significant help from Phillip Porras and Matt Jonkman. Livio and Phil collaborated (from 1995 to 2000) at the Computer Science Laboratory of SRI International, where intrusion detection was first developed back in 1983. Following recent compelling research results and prior commercial success, the founders were commissioned by the National Science Foundation and The Army Research Office to commercialize recent, significant results in network security research through the founding of MetaFlows in 2007. The resulting product, The MetaFlows Security System, (MSS) was launched in 2012 and its commercial adoption has been growing organically since then, thanks to its strong technical differentiations. Most of the team members at MetaFlows have an engineering background and are exclusively focused on product development and customer support.

Despite the lack of marketing focus, MetaFlows' products are today enjoying considerable traction as they demonstrably provide an unprecedented combination of cost-effectiveness and sophistication in the detection and prevention of malware and other network-based attacks.

MetaFlows is located in the heart of the beautiful city of San Diego [2], right across from Petco Park, MLB, home of the San Diego Padres.

Frequently Asked Questions

Where can I interact with other MetaFlows customers?

If you check out the MetaFlows Google Groups [[3]], you can participate in ongoing discussions or create your own.

Windows Users

Click on the windows logo and start a command shell by typing cmd.
In the command window type ipconfig and hit Enter:

C:>ipconfig

A portion of the output from the above command is shown below:

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : xxy.ca.comcast.net.

IPv4 Address. . . . . . . . . . . : 192.168.1.4

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.1

The IPv4 address contains the Home Network IP address. In our Example '192.168.1.0' would be our home network ip address. The last digit '4' in the example above refers to the host IP address i.e. IP address of the computer. For additional information on windows networking click here.

Linux Users

In a Unix terminal type ifconfig and hit Enter. An example output is shown below:

$ ifconfig

eth0 Link encap:Ethernet HWaddr 00:0C:29:90:A5:26

inet addr:192.168.1.18 Bcast:192.168.1.255 Mask:255.255.255.0

inet6 addr: fe80::20c:29ff:fe90:a526/64 Scope:Link

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:75 errors:0 dropped:0 overruns:0 frame:0

TX packets:51 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:11570 (11.2 KiB) TX bytes:9067 (8.8 KiB)

Interrupt:67 Base address:0x2000

In the output above the fields inet addr and Mask provide the Home Network IP address. In our example the home network ip address is 192.168.1.0.

What is Network Address Translation (NAT)?

Network Address Translation (NAT) is designed for IP address conservation. It enables private IP networks that use unregistered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks together, and translates the private (not globally unique) addresses in the internal network into legal addresses, before packets are forwarded to another network.

Network Address Translation allows multiple computers within a home or organization to use one public IP address to access the internet. This public IP address is usually assigned to the home or company router. For more information please refer to the the following Wikipedia article Network Address Translation

Why I do not see my sensors when I click on View Sensors?

It could be a browser bug that is preventing display of your sensors. Close Firefox and restart the browser and login to your account. Click on View Sensors and you should see your sensors should be visible.

How do I remove specific flows from reports?

Sometimes it is desirable to filter out flows to a certain server. For example, the sensor communicating to MetaFlows servers might show up in the top flows in the Real Time report window if the traffic that is being monitored is not heavy.

Filtering these flows from the reports is easy.

• Click on View Sensors and select the Advanced Variables in Sensor Variables form.
• Next select the 'Advanced Variables' check-box which will reveal the Filter field.

For filtering flows to one of the MetaFlows server you can enter the following pcap expression.

not host 71.165.162.10

You could include multiple hosts for filtering by concatenating them as shown below:

not host 71.165.162.10 and not host 71.165.162.13 and not host 71.165.162.11

After entering the expression, click on Save Changes. You will then be prompted to Reload the sensor due to the change in sensor configuration. When the sensor has reload, you will not see the flows to the IP address specified above in the Reports window.

More details can be found on packet filtering as part of sensor creation process here.

Main Page