From MetaFlows User Manual
Jump to: navigation, search


Physical Address 715 J St #205, San Diego, CA, 92101
Web Address [1]
Phone 1-877-664-7774
Phone 1-408-457-1895
Fax 1-877-539-7778

MetaFlows, Inc. is a California corporation founded in 2007 by Livio Ricciulli, with significant help from Phillip Porras and Matt Jonkman. Livio and Phil collaborated (from 1995 to 2000) at the Computer Science Laboratory of SRI International, where intrusion detection was first developed back in 1983. Following recent compelling research results and prior commercial success, the founders were commissioned by the National Science Foundation and The Army Research Office to commercialize recent, significant results in network security research through the founding of MetaFlows in 2007. The resulting product, The MetaFlows Security System, (MSS) was launched in 2012 and its commercial adoption has been growing organically since then, thanks to its strong technical differentiations. Most of the team members at MetaFlows have an engineering background and are exclusively focused on product development and customer support.

Despite the lack of marketing focus, MetaFlows' products are today enjoying considerable traction as they demonstrably provide an unprecedented combination of cost-effectiveness and sophistication in the detection and prevention of malware and other network-based attacks.

MetaFlows is located in the heart of the beautiful city of San Diego [2], right across from Petco Park, MLB, home of the San Diego Padres.

Frequently Asked Questions

Where can I interact with other MetaFlows customers?

If you check out the MetaFlows Google Groups [[3]], you can participate in ongoing discussions or create your own.

How do I find my home network IP address?

Windows Users

Click on the windows logo and start a command shell by typing cmd.
In the command window type ipconfig and hit Enter:


A portion of the output from the above command is shown below:

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . :
Subnet Mask . . . . . . . . . . . :
Default Gateway . . . . . . . . . :

The IPv4 address contains the Home Network IP address. In our Example '' would be our home network ip address. The last digit '4' in the example above refers to the host IP address i.e. IP address of the computer. For additional information on windows networking click here.

Linux Users

In a Unix terminal type ifconfig and hit Enter. An example output is shown below:

$ ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:90:A5:26
inet addr: Bcast: Mask:
inet6 addr: fe80::20c:29ff:fe90:a526/64 Scope:Link
RX packets:75 errors:0 dropped:0 overruns:0 frame:0
TX packets:51 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:11570 (11.2 KiB) TX bytes:9067 (8.8 KiB)
Interrupt:67 Base address:0x2000

In the output above the fields inet addr and Mask provide the Home Network IP address. In our example the home network ip address is

What is Virtual Tap?

Virtual Tap(tm) allows you to passively monitor all traffic on your network without installing any hardware TAP or managed firewall. Let it learn your topology and MAC addresses for a day or so then take it out of learning mode and disable your existing DHCP server. Clients and servers simply renew their IP addresses and start being monitored. This works also for servers that get forwarded traffic from your existing natting firewall.

What is Network Address Translation (NAT)?

Network Address Translation (NAT) is designed for IP address conservation. It enables private IP networks that use unregistered IP addresses to connect to the Internet. NAT operates on a router, usually connecting two networks together, and translates the private (not globally unique) addresses in the internal network into legal addresses, before packets are forwarded to another network.

Network Address Translation allows multiple computers within a home or organization to use one public IP address to access the internet. This public IP address is usually assigned to the home or company router. For more information please refer to the the following Wikipedia article Network Address Translation

Why I do not see my sensors when I click on View Sensors?

It could be a browser bug that is preventing display of your sensors. Close Firefox and restart the browser and login to your account. Click on View Sensors and you should see your sensors should be visible.

How do I remove specific flows from reports?

Sometimes it is desirable to filter out flows to a certain server. For example, the sensor communicating to MetaFlows servers might show up in the top flows in the Real Time report window if the traffic that is being monitored is not heavy.

Filtering these flows from the reports is easy.

  • Click on View Sensors and select the Advanced Variables in Sensor Variables form.
  • Next select the 'Advanced Variables' check-box which will reveal the Filter field.

For filtering flows to one of the MetaFlows server you can enter the following pcap expression.

not host

You could include multiple hosts for filtering by concatenating them as shown below:

not host and not host and not host

After entering the expression, click on Save Changes. You will then be prompted to Reload the sensor due to the change in sensor configuration. When the sensor has reload, you will not see the flows to the IP address specified above in the Reports window.

More details can be found on packet filtering as part of sensor creation process here.

Main Page