Server Detection Approaches

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

The serverDetectionApproach tag contains a list of approaches used to resolve client server relation.

ListenPortsBasedApproach

Resolves a relation based on the LISTEN or ESTABLISHED connection state. It is necessary to run process-to-process discovery to be able to use that approach. If the port is opened for listening the host is resolved as server, so the second member of a connection is resolved as client automatically; and vice versa.

KnownPortsBasedApproach

Resolves a relation based on known a server port list defined in the portNumberToPortName.xml file.

StatisticBasedApproach

Resolves a relation based on a minimal condition. If the condition value is zero it is not taken in to account. Valid conditions are:

minClients. Minimum connections count to indicate host as a server.
minPackets. Minimum total packets count sent and received by a host to indicate it as a server.
minOctets. Minimum total octets count sent and received by a host to indicate it as a server.

Note An approach can be deactivated if its active attribute is set to false or the tag responsible for the approach is commented out or removed.