Configuring the probe

Most deployments run on defaults. When you need to tune what the probe collects — turn on sFlow, enable packet capture, change SNMP communities — you edit its YAML config.

Where the config lives

The container reads its config from /etc/probe-mcp/probe.yaml. Mount your file there (read-only) when you run the container.

Settings are resolved in this order, later winning:

1. Compiled-in defaults
2. The YAML file
3. Environment variables

So you can override a single knob with an env var without editing the file. Only cloud_url and data_dir are strictly required, and both have defaults.

Global settings

Key	Default
cloud_url	https://probe-mcp.lanpulse.com
data_dir	/var/lib/probe-mcp
log_level	info (debug, info, warn, error)

probe_id, probe_secret, and activation_code are normally set by activation, not by hand.

Collector sections and defaults

Section	Key defaults	Enabled by default?
syslog	udp_port: 514, tcp_port: 514, max_msg_len: 8192	Yes
snmp	version: "2c", communities: ["public"], poll_interval: 60, auto_discover: true	Yes (outbound poll to UDP 161)
snmp_trap	udp_port: 162 (inherits snmp.communities if empty)	Yes
flow_collector	sflow_port: 6343, netflow_port: 2055, aggregation_sec: 300, top_n: 10	No
discovery	interval_sec: 300, arp_watch: true, mdns/ssdp/lldp: true, ping_sweep: false	Yes (ping sweep off)
pcap	interfaces: [] (all up), bpf: "", ring_bytes: 1 GiB, snap_len: 1600	No
ssh	max_sessions: 5, idle_timeout_sec: 600	No
tftp	port: 69, ttl_sec: 300, max_kb: 1024	No
liveness	interval_sec: 60, timeout_sec: 600	No
reach_through	allowed_hosts: [], max_bytes: 8 MiB, timeout_sec: 8	No
vault	max_entries: 128	Yes
api	listen_addr: "127.0.0.1:8080"	Yes
tunnel	health_check_sec: 30, metrics_addr: "127.0.0.1:20241"	Yes
rollup	interval_sec: 60	Yes
buffer	max_size_mb: 256, flush_on_drain: true	(always on)
retention	max_age_hours: 168 (7 days), max_size_mb: 1024	(always on)

Enabling optional services

The most common changes:

• sFlow / NetFlow — set flow_collector.enabled: true, then point exporters at UDP 6343 / 2055. See Pointing your network at the probe.
• Packet capture — set pcap.enabled: true and (optionally) pcap.interfaces / pcap.bpf. Capture is Linux-only and needs the CAP_NET_RAW capability.
• SSH device CLI — set ssh.enabled: true to allow on-demand SSH sessions to devices.
• Active discovery — set discovery.ping_sweep: true to ICMP-sweep the subnet in addition to passive discovery.

Caution

Some features need Linux capabilities the base container doesn’t grant on its own: packet capture and LLDP discovery need CAP_NET_RAW. Grant them explicitly when you run the container. See the Security model for the privileges the probe uses.

Command-line flags

The probe binary accepts:

Flag	Default	Purpose
-config	""	Path to the config file.
-log-level	""	Override the log level (debug/info/warn/error).
-version	false	Print version and exit.

Environment-variable overrides

Handy for one-off overrides without touching the file:

Env var	Overrides
ACTIVATION_CODE	The one-time activation code (first start only).
PROBE_CLOUD_URL	cloud_url
PROBE_DATA_DIR	data_dir
PROBE_LOG_LEVEL	log_level
PROBE_API_LISTEN	api.listen_addr
PROBE_PCAP_ENABLED	pcap.enabled (1/true)
PROBE_PCAP_INTERFACES	pcap.interfaces (comma-separated)
PROBE_PCAP_BPF	pcap.bpf

PROBE_ID, PROBE_SECRET, and PROBE_TUNNEL_METRICS_ADDR are also honored but are normally managed by activation.