Config.json Reference

Complete reference for every field in /etc/ftagent/config.json. Created by ftagent --setup, permissions chmod 600.

Core Fields

Field	Type	Default	Description
api_key*	string	`""`	Per-node API key from the Flowtriq dashboard.
node_uuid*	string	`""`	Node UUID from the Flowtriq dashboard.
api_base	string	`"https://flowtriq.com/api/v1"`	API base URL. Change only for white-label deployments.
interface	string	`"auto"`	Network interface to monitor. `"auto"` detects the primary interface.

PCAP Capture

Field	Type	Default	Description
pcap_enabled	bool	`true`	Enable packet capture for forensic analysis.
pcap_mode	string	`"tcpdump"`	`"tcpdump"` (near-zero CPU) or `"scapy"` (per-packet Python analysis).
pcap_dir	string	`"/var/lib/ftagent/pcaps"`	PCAP storage directory.

Logging

Field	Type	Default	Description
log_file	string	`"/var/log/ftagent.log"`	Log file path.
log_level	string	`"INFO"`	`DEBUG`, `INFO`, `WARNING`, `ERROR`.

Detection and Baselines

Field	Type	Default	Description
dynamic_threshold	bool	`true`	Use EWMA-based dynamic thresholds.
baseline_window	int	`300`	Seconds of traffic samples for rolling baseline.
health_port	int	`9100`	Health check HTTP port. `0` to disable.
auto_update	bool	`true`	Daily update check on startup (non-blocking).

Flow Protocol Collector

Field	Type	Default	Description
flow_enabled	bool	`false`	Enable sFlow/NetFlow/IPFIX collector.
flow_protocol	string	`"auto"`	`"auto"`, `"sflow"`, `"netflow_v5"`, `"netflow_v9"`, or `"ipfix"`.
flow_port	int	`0`	Listen port. `0` = protocol default (sFlow: 6343, NetFlow: 2055, IPFIX: 4739).
flow_bind	string	`"0.0.0.0"`	Bind address for flow listener.
flow_sample_rate	int	`0`	Override sample rate. `0` = use packet-embedded rate.
flow_source_ips	array	`[]`	Allowed source IPs (empty = accept all).

GRE Deduplication

Field	Type	Default	Description
gre_mode	string	`"auto"`	`"auto"`, `"enabled"`, or `"disabled"`.
gre_max_depth	int	`3`	Max nested GRE layers to strip.
hypervisor_mode	bool	`false`	Per-VM tracking when GRE is active.
vm_labels	object	`{}`	Inner IP to label map: `{"10.0.0.5": "Customer A"}`

Mirror / SPAN Mode

Field	Type	Default	Description
mirror_mode	bool	`false`	Enable mirror/SPAN per-IP detection.
mirror_interface	string	`""`	NIC connected to SPAN port (required when mirror_mode is true).
mirror_subnets	array	`[]`	Monitored CIDRs. Empty = all traffic.
mirror_ip_labels	object	`{}`	Destination IP display names.
mirror_capture_mode	string	`"af_packet"`	`"af_packet"` (high perf) or `"tcpdump"` (fallback).

Full Example Config

{
  "api_key":           "ft_live_abc123def456...",
  "node_uuid":         "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "api_base":          "https://flowtriq.com/api/v1",
  "interface":         "auto",
  "pcap_enabled":      true,
  "pcap_mode":         "tcpdump",
  "pcap_dir":          "/var/lib/ftagent/pcaps",
  "log_file":          "/var/log/ftagent.log",
  "log_level":         "INFO",
  "dynamic_threshold": true,
  "baseline_window":   300,
  "health_port":       9100,
  "auto_update":       true,
  "flow_enabled":      false,
  "flow_protocol":     "auto",
  "flow_port":         0,
  "gre_mode":          "auto",
  "mirror_mode":       false
}

Minimal Config

{
  "api_key":   "ft_live_abc123def456...",
  "node_uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Config Validation Errors

Error	Cause	Fix
No api_key configured	Empty api_key	Run `ftagent --setup`
No node_uuid configured	Empty node_uuid	Copy UUID from dashboard
Invalid JSON in config	Syntax error	Validate: `python3 -m json.tool /etc/ftagent/config.json`