PRTG Manual: IP Reputation Score Sensor

Parent device

If a domain name is used as the hostname of the parent device, PRTG resolves it to an IP address before querying blacklist servers.

IPv6

This sensor supports IPv6.

Performance impact

This sensor has a low performance impact.

Limits

• This sensor has predefined limits for one or several metrics.
• During normal operation, there should be 0 hits and the sensor should show the Up status. If the sensor can find the IP address on at least one of the blacklist servers, it shows the Warning status by default. You can set additional thresholds with channel limits in the channel settings.

Knowledge Base

Knowledge Base: Is there a list of anti spam black list servers?

DNS Resolver

Select which resolver the sensor sends the requests to.

• System (default): Use the DNS resolver from the operating system of the parent device.
• Custom: Use a DNS resolver from a defined IP address and port.

Custom Resolver

This setting is only visible if you select Custom above.

Enter the IP address or hostname of the custom DNS resolver.

Port

This setting is only visible if you select Custom above.

Enter the port for the connection to the custom DNS resolver. The default port is 53. PRTG supports the port numbers 1 to 65535. Enter an integer.

Blacklist Servers

Define the DNS blacklist servers that the sensor uses for the check. The default server is bl.spamcop.net. Enter one blacklist server per line in the format domain or domain=filter.

• The domain is the DNS blacklist server hostname.
• The optional filter restricts which DNS response addresses count as a match. The filter supports exact matches, value lists, and ranges:
  • Exact match: 127.0.0.2
  • Value list: 127.0.0.[10;11]
  • Range: 127.[0..255].[0..255].2

Optionally, add a score to the domain in the format domain*score or domain=filter*score. The score is the number of points added to the total blacklist score for each match. Enter an integer. PRTG defaults to a score of 1 if you do not enter a score.

You can use a higher score for blacklist servers that you consider more reliable or accurate. If you are only interested in whether the IP address of the parent device is on a blacklist, you do not need to assign scores to any of the blacklist servers.

Example

zen.spamhaus.org=127.0.0.2*3
bl.spamcop.net*2

We recommend that the blacklist server list that you enter in this sensor matches the list on your email server prevent monitoring gaps. Then, if you want the sensor to warn you about specific blacklist servers before others, assign different scores and adjust the channel limits in the Score channel.

For a list of servers, see the Knowledge Base: Is there a list of anti spam black list servers?

Primary Channel

Select a channel from the list to define it as the primary channel. In the device tree, PRTG displays the last value of the primary channel below the sensor's name. The available options depend on what channels are available for this sensor.

You can set a different primary channel later by clicking below a channel gauge on the sensor's Overview tab.

Graph Type

Define how this sensor shows different channels:

• Show channels independently (default): Show a graph for each channel.
• Stack channels on top of each other: Stack channels on top of each other to create a multi-channel graph. This generates a graph that visualizes the different components of your total traffic.
  You cannot use this option in combination with manual Vertical Axis Scaling (available in the channel settings).

Stack Unit

This setting is only visible if you select Stack channels on top of each other above.

Select a unit from the list. PRTG stacks all channels with this unit on top of each other. By default, you cannot exclude single channels from stacking if they use the selected unit. However, there is an advanced procedure to do so.

Result Handling

Define what PRTG does with the sensor result:

• Discard result (default): Do not store the sensor result.
• Store result: Store the sensor result and the last response in the \Logs\sensors subfolder of the PRTG data directory on the probe system. The file name is Result of Sensor [ID].log. This setting is for debugging purposes. PRTG overwrites this file with each scanning interval.

This option is not available when the sensor runs on the hosted probe of a PRTG Hosted Monitor instance.

In a cluster, PRTG stores the result in the PRTG data directory of the master node.

Downtime

In the channel table on the Overview tab, this channel never shows any values. PRTG uses this channel in graphs and reports to show the amount of time in which the sensor was in the Down status.

Score

The sum of all IP reputation scores from the servers that are listed in Blacklist Servers

This channel has default limits:

• Upper warning limit: 0

This channel is the primary channel by default.

Servers Reachable

The percentage of configured servers that are reachable

This channel has default limits:

• • Lower error limit: 50%
  • Lower warning limit: 80%