oott/examples/sample_oott.toml

[database]
path = "/db/oott.db" # Database path. For the Docker image this must be "/db/oott.db" (the mounted volume); make sure it's writeable for the user running this process

[networking]
# interface = "eno1" # Optional: network interface to use for scans. If not set, the first non-loopback connected interface is used.

[log]
level = "info" # off, error, warn, info, debug, trace

[arp_scanner] # Optional: omit this whole section to use the defaults shown below
enabled=true # Set to false to disable the ARP scanner
wait_between_scans="30m" # Wait time between scans. This does not include the scan time
sender_timeout="1m" # If the ARP sender process takes longer than this it will be stopped (for a class C network - 254 IPs - it should take less than a minute)
scan_duration="10m" # How long to wait for response packets on each scan (5m to 10m is a good timeframe for a class B or C network)

[mdns_scanner]
enabled=true # Set to false to disable the mDNS/Bonjour scanner
probe_timeout="2s" # When an mDNS-discovered IP is not in the OS ARP cache, how long to wait for a targeted ARP probe reply to resolve its MAC address

[ssdp_scanner]
enabled=true # Set to false to disable the SSDP/UPnP scanner
probe_timeout="2s" # When an SSDP/UPnP-discovered IP is not in the OS ARP cache, how long to wait for a targeted ARP probe reply to resolve its MAC address

[dhcp_scanner]
enabled=true # Set to false to disable the DHCP scanner

# [snmp_scanner] # Optional: poll a router/firewall's ARP table over SNMP. Disabled unless this section is present.
# enabled=true # Set to false to disable the SNMP scanner without removing this section
# target="192.168.1.1:161" # SNMP agent to poll, as host:port. Point this at your gateway (router/firewall).
# community="public" # SNMPv2c read-only community string. Use a read-only community; never commit a real secret here.
# wait_between_scans="10m" # Wait time between polls. Keep this well under the agent's ARP cache timeout so active devices aren't missed.
# timeout="5s" # Per-poll SNMP request timeout.
# Note: SNMP must be enabled on the target. On pfSense: Services > SNMP (v2c; the mibII module exposes the ARP table).
# On OPNsense: install the os-net-snmp plugin, then Services > Net-SNMP. In both cases add a firewall rule allowing
# UDP/161 from the host running OOTT.

[notifications]
method="pushover" # For now just pushover, you can set this to "none" to avoid sending notifications (it will just log)
notify_when_not_seen_for="1w" # Send a notification if a device comes back online after not being seen for this timeframe

[notifications.pushover]
token="" # Your pushover token goes here, just copy&paste from their website after creating the app
user_key="" # User key goes here, this is the account wide code for pushover

[web_server]
ip_address="0.0.0.0" # IP to bind the web server for the API and web UI to, use 0.0.0.0 to bind it to all interfaces
port=3000 # Port to listen on
api_key="CHANGE_ME" # API Key to use the system's API, change this!

[retention]
window="365d" # How long to keep device events and notifications. Records older than this are deleted daily. Supports: d (days), w (weeks), h (hours), m (minutes)

[device_events]
deduplication_window="1m" # If the same scanner sees the same device (same MAC and IP) again within this window, only one device event is recorded. Keeps the events table from filling with near-identical rows. Supports: d (days), w (weeks), h (hours), m (minutes), s (seconds)