Configuring the probe

Most deployments run on defaults. When you need to tune what the probe collects — turn on sFlow, enable packet capture, change SNMP communities — you edit its YAML config.

Where the config lives

The container reads its config from /etc/probe-mcp/probe.yaml. Mount your file there (read-only) when you run the container.

Settings are resolved in this order, later winning:

1. Compiled-in defaults
2. The YAML file
3. Environment variables

So you can override a single knob with an env var without editing the file. Only cloud_url and data_dir are strictly required, and both have defaults.

A fourth source exists that you don’t edit: the engine can send the probe a config downlink, which the probe stores and applies on top of the above. That is how a linked R1-MCP provisions LBS venue credentials. The probe validates a downlink per block — if one block is bad it keeps its previous values for that block, applies the rest of the document, and reports a config_rejected fault on every heartbeat until a valid document replaces it. You’ll see that in probe_status; see Troubleshooting.

Global settings

Key	Default
cloud_url	https://probe-mcp.lanpulse.com
data_dir	/var/lib/probe-mcp
log_level	info (debug, info, warn, error)

probe_id, probe_secret, and activation_code are normally set by activation, not by hand.

Collector sections and defaults

Section	Key defaults	Enabled by default?
syslog	udp_port: 514, tcp_port: 514, max_msg_len: 8192	Yes
snmp	version: "2c", communities: ["public"], poll_interval: 60, auto_discover: true	Yes (outbound poll to UDP 161)
snmp_trap	udp_port: 162 (inherits snmp.communities if empty)	Yes
flow_collector	sflow_port: 6343, netflow_port: 2055, aggregation_sec: 300, top_n: 10	No
discovery	interval_sec: 300, arp_watch: true, mdns/ssdp/lldp: true, ping_sweep: false	Yes (ping sweep off)
pcap	interfaces: [] (all up), bpf: "", ring_bytes: 1 GiB, snap_len: 1600	No
ssh	max_sessions: 5, idle_timeout_sec: 600	No
tftp	port: 69, ttl_sec: 300, max_kb: 1024	No
liveness	interval_sec: 60, timeout_sec: 600	No
reach_through	allowed_hosts: [], max_bytes: 8 MiB, timeout_sec: 8	No
vault	max_entries: 128	Yes
lbs	port: 8883, local_port: 1883, report_interval_sec: 6, duration_min: 60, bands: [1, 2], include_randomized: false	No
api	listen_addr: "127.0.0.1:8080"	Yes
tunnel	health_check_sec: 30, metrics_addr: "127.0.0.1:20241"	Yes
rollup	interval_sec: 60	Yes
buffer	max_size_mb: 256, flush_on_drain: true	(always on)
retention	max_age_hours: 168 (7 days), max_size_mb: 1024	(always on)

Enabling optional services

The most common changes:

• sFlow / NetFlow — set flow_collector.enabled: true, then point exporters at UDP 6343 / 2055. See Pointing your network at the probe.
• Packet capture — set pcap.enabled: true and (optionally) pcap.interfaces / pcap.bpf. Capture is Linux-only and needs the CAP_NET_RAW capability.
• SSH device CLI — set ssh.enabled: true to allow on-demand SSH sessions to devices.
• Active discovery — set discovery.ping_sweep: true to ICMP-sweep the subnet in addition to passive discovery.
• Reach-through — set reach_through.enabled: true to let https_forward call a private on-prem controller through the probe. Leave allowed_hosts empty to permit any private host, or list exact hosts to narrow it further.
• Config-restore TFTP — set tftp.enabled: true for the serve_tftp pair used by R1-MCP’s Test Bed Manager.

The lbs block is the exception to all of this: you don’t set lbs.enabled yourself. It is switched on when R1-MCP registers an LBS source against the probe and off when the last one is removed, and the venue credentials under lbs.venues arrive the same way. The rest of the block — port, bands, reporting interval — is yours, and a downlink carries your values through untouched. See Telemetry forwarding to R1-MCP.

Each of these fails with a distinct error while it’s off — pcap disabled, ssh proxy disabled, reach_through disabled, tftp disabled, flow collector not enabled — so a failing call tells you which key to set.

Caution

Some features need Linux capabilities the base container doesn’t grant on its own: packet capture and LLDP discovery need CAP_NET_RAW. Grant them explicitly when you run the container. See the Security model for the privileges the probe uses.

Command-line flags

The probe binary accepts:

Flag	Default	Purpose
-config	""	Path to the config file.
-log-level	""	Override the log level (debug/info/warn/error).
-version	false	Print version and exit.

Environment-variable overrides

Handy for one-off overrides without touching the file:

Env var	Overrides
ACTIVATION_CODE	The one-time activation code (first start only).
PROBE_CLOUD_URL	cloud_url
PROBE_DATA_DIR	data_dir
PROBE_LOG_LEVEL	log_level
PROBE_API_LISTEN	api.listen_addr
PROBE_PCAP_ENABLED	pcap.enabled (1/true)
PROBE_PCAP_INTERFACES	pcap.interfaces (comma-separated)
PROBE_PCAP_BPF	pcap.bpf

PROBE_ID, PROBE_SECRET, and PROBE_TUNNEL_METRICS_ADDR are also honored but are normally managed by activation.

Next steps

Limits and budgets What each of these settings caps at, and the retention windows they control.

Pointing your network at the probe The collector ports to configure on switches, APs, and firewalls.

Security model The container privileges each optional service needs.