How to configure an Intel 10 Gigabit capture card for use in an RSA Security Analytics or RSA NetWitness decoder. How do I configure my Intel 10 Gigabit capture card for use in a NetWitness Decoder?
IMPORTANT NOTE: This procedure is intended only for RSA NetWitness NextGen decoders and for RSA Security Analytics decoder at version 10.3.x. and below. For appliances running RSA Security Analytics version 10.4.x, refer to the procedure in the RSA Security Analytics v10.4 10G Decoder Installation Guide.
Follow the steps below to configure the capture card on the decoder appliance.
1. Check the kernel version of your appliance with the uname -a command. It should display the kernel version or higher that is shown in the following example:
CentOS 6: [root@decoder ~]# uname -a Linux decoder 2.6.32-220.17.1.el6.x86_64 #1 SMP Wed May 16 00:01:37 BST 2012 x86_64 x86_64 x86_64 GNU/Linux
11a. To avoid unforeseen issues with the new driver, it is recommended at this point that you completely shutdown and power-cycle your Decoder to allow the new firmware provided by the driver to take effect.
shutdown -h now
11b. If you do not wish to power-cycle at this time, restart the network services
service network restart
Perform Step 12 before performing the next step of restarting decoder service.
14. If you performed step 11b rather then step 11a (OS restart), you may need to reselect the capture interface in decoder's configuration.
15.If after starting the decoder service, significant drops begin to occur at the interface level, contact RSA Support for additional assistance. Some interface-level drops are normal at high traffic capture rates.