TLD Lua Parser Options

Document created by RSA Information Design and Development Employee on Mar 6, 2017Last modified by RSA Information Design and Development Employee on Feb 14, 2020
Version 165Show Document
  • View in full screen mode

Caution: RSA strongly suggests that you do not subscribe to the options file. Subsequent downloads of this file will overwrite all changes that you have made to the file.

Note the following:

  • If you deploy the options file, it can be found in the same directory as parsers: /etc/netwitness/ng/parsers/.
  • The parser is not dependent upon the options file. The parser will load and run even in the absence of the options file. The options file is only required if you need to change the default settings.
  • If you do not have an options file (or if your options file is invalid), the parser uses the default settings.

Note: The parser will never use both the defaults and customized options. If the options file exists and its contents can be loaded, then the defaults will not be used at all.

The TLD_lua_options file contains the following options for controlling the parser:

  • deduplicate

  • localDomains

To change an option from false to true, edit the line inside the corresponding function, from

return false


return true

And similarly to go from true to false.



Modifying any of these options requires a service restart to take effect; a simple parser reload is insufficient.


Default value: true

By default tld, cctld, and sld, meta are only registered once per session, regardless of the number of times seen.

Disabling this option (setting to false) causes the parser to register all tld, cctld, and sld meta even if they have already been registered previously for that session.


List of domain suffixes or TLDs specific to the internal network. Multiple values must be comma-separated, for example:


Default value: local

You are here
Table of Contents > RSA NetWitness Platform Content > Parsers > Lua Packet Parsers > TLD Lua Parser Options