Updating network interfaces for traffic capture using DPDK in a multiserver configuration · PT NAD

Updating PT NADUpdating PT NAD to version 11.1 in a multiserver configuration manuallySetting up traffic capture using the DPDK tool in a multiserver configuration

Updating network interfaces for traffic capture using DPDK in a multiserver configuration

When switching from PF_RING or AF_PACKET to DPDK, you need to specify the names of the network interfaces (in a new format) from which the sensor will capture traffic. You can view the list of network interfaces using the ptdpictl devlist command on the additional sensor sever. In the command output, an interface name is at the beginning of the block of each interface (starting with pci-, for example, pci-02-00-0).

To update the names of the network interfaces for traffic capture using DPDK:On the additional sensor server, open the /opt/ptsecurity/etc/ptdpi.settings.yaml file:

sudo nano /opt/ptsecurity/etc/ptdpi.settings.yaml

In the Capture settings section in the capture_if setting, specify and separate by space character the names of network interfaces whose traffic must be captured, for example:

capture_if: pci-02-02-0 pci-03-00-0

If traffic capture is performed using the ERSPAN technology, specify the IP address of the network interface on which PT NAD must receive traffic:

dpdk.interfaces.<name of the network interface from the previous step>: { ip-addr: <IP address of the interface> }

For example:

 dpdk.interfaces.pci-02-00-0: { ip-addr: 203.0.113.12 }
dpdk.interfaces.pci-03-00-0: { ip-addr: 203.0.113.13 }

After the restart, the sensor will respond to ARP requests for the specified IP address on the selected interface. You can specify different or identical IP addresses for different interfaces or do not specify them at all (as by default).

Save the changes in the /opt/ptsecurity/etc/ptdpi.settings.yaml file.The network interfaces specified in the capture_if setting become available to the sensor and unavailable to the operating system when DPDK is used after the update is completed.

If you specified a wrong network interface in the sensor configuration, you can return it to be used in the operating system with the command /opt/ptsecurity/dpi/configure-nif.sh down <Network interface name>, for example, /opt/ptsecurity/dpi/configure-nif.sh down pci-02-00-0.

The names of the network interfaces for traffic capture are now updated.

Recommendations for delivering traffic to PT NAD

	dpdk.interfaces.pci-02-00-0: { ip-addr: 203.0.113.12 }
	dpdk.interfaces.pci-03-00-0: { ip-addr: 203.0.113.13 }