• System Section
• Interface Section
• Routing Section
• Mangling Section
• IP Lists
• Actions
• Modules

• Interface Tests
• Ethernet Tests
• IP Tests
• ICMP Tests
• TCP Tests
• UDP Tests
• TCPStream Tests
• DNS Tests
• HTTP Tests
• Includes

The system section isn't very critical. This is mostly where you set the system ID and that sort of thing. Here's and example system:

<system>
Name=Hogwash Sensor
ID=1001
Threads=1
</system>

Name="Name"

Name can be any name that is useful to you. It is used in some of the log files and some of the reports.

ID="ID"

ID is just like name, set it to any numeric value you want. It is used in some of the log files and some of the reports.

Threads=0..n

Setting Threads=0 puts Hogwash into single threaded mode. If you specify more than one interface in the <interface> section and set Threads=0, all the interfaces must be pollable. Hogwash will exit with an error if they're not.

If Threads=1, Hogwash will spawn a thread for each interface and one packet processing thread. For Threads=n, hogwash will spawn one thread for each interface and then n packet processing threads.