Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Observability › Hosting Telemetry

Hosting Telemetry

Hosting network telemetry interpretation

Purpose

Interpret Hosting telemetry as investigation signals, not as proof that the node is filtering packets. Missing collectors are often ACL/path, not “the Agent is down.”

Audience

Operators reading Hosting Network Security UI, Hosting status counters, and category-safe events.

Edition

ENTERPRISE_ONLY.

Status

SUPPORTED. Detector classes are conservative. Closed-port emits only when inferable. Drops on observation programs must remain zero.

Prerequisites

Loader + Hosting Agent active. Admin JWT. GET /api/v1/agents/:id/hosting/status.

Required permissions

Admin. Node root only to inspect the loader socket or units.

Dependencies

hosting_observe.o pass-only programs; UNIX socket /run/zwall-hosting-ebpf/observer.sock; Hosting event contract (no unrestricted packet fields).

Configuration

See Network observation. Do not enable Virtualization firewall objects to “make telemetry stronger.”

Procedure

  1. Confirm units:
systemctl is-active zwall-hosting-ebpf-loader
systemctl is-active zwall-hosting-agent
# or zwall-hosting-agent-v2
  1. Read Hosting status: runtime_available, source states (active, permission_blocked, source_not_present, parser_unsupported, …), observation_only, network attach lists, ScanEventCounts. Collection status COLLECTING with runtime_available: false means no accepted snapshot yet — wait for heartbeat, do not treat it as packet drop.
  2. Treat permission_blocked / source_not_present as collector explanations, not network detector failures.
  3. Read Hosting events projection (event_id, source, category, severity, timestamp, parser, contract_version, review_state).
  4. Map network categories to conservative detectors: vertical/horizontal scan, SYN fan-out, UDP heuristic, burst, TCP-flag anomalies, closed-port when inferable, unique dest port/host rates. Action is logged only.
  5. If you need source_ip for an investigation, that evidence belongs on a Virtualization Agent’s security logs or an external system — not the Hosting projection.
  6. Confirm drops remain zero. Non-zero on this profile is a defect or a mixed zwall-agent.service.

Verification

  • Status shows attached interfaces matching ZWALL_HOSTING_INTERFACES (eligible/XDP/TC lists) when the loader is up.
  • Events, if any, lack raw payload and customer IPs.
  • Packet forwarding still works.
  • Parser health fields are present on sources that are active.

Expected result

Bounded metadata that supports investigation. No claim that Hosting “blocked the attack.”

Failure modes

Scroll sideways to see the full table. Use the arrow keys when focused.

ReadingMeaning
Counters zero, sources blockedfix exact-path ACLs; network may still be attached
Counters zero, socket missingstart loader; confirm SHA-256 env
“No IPs so telemetry is broken”contract is category-safe
Drops > 0wrong profile or product defect
Status 4xxnot a Hosting v2 Agent

Troubleshooting

Hosting troubleshooting, Missing telemetry. Check heartbeat observation_only and loader socket before blaming ingest.

Security considerations

Do not reconstruct customer addresses from prefix identifiers in tickets. Hosting sources are excluded from automatic/provider AI. Do not attach customer log excerpts.

Limitations

Not payload capture. Not a firewall. Not lossless. Isolated kernel 5.4 attach evidence is not a global matrix. No shipped universal ACL.