Install an SSD for Packet Capture on the ExtraHop Discover Appliance
This guide explains how to install the SSD for packet capture on the EH3000, EH6000, EDA 6100, EH8000, EDA 8100, and EDA 9100 ExtraHop Discover appliances.
Note: | You must have write access to the ExtraHop Web UI and access to the ExtraHop Admin UI to complete the steps in this guide. |
Confirm whether packet capture is enabled
- From the Admin UI, in the Appliance Settings section, click License.
-
In the Features section, verify the packet capture status.
- If packet capture is enabled, proceed to Write triggers for the packet capture.
- If packet capture is disabled, proceed to Enable packet capture.
Enable packet capture
The ExtraHop Discover appliance requires a product key and a license to configure packet capture. In addition, outbound DNS connectivity is required to install the SSD for packet capture.
If you do not have a product key, contact your ExtraHop account team.
Write triggers for the packet capture
When packet capture is enabled, you can write triggers to specify and deploy targeted packet captures from the ExtraHop appliance to an SSD installed on your ExtraHop appliance or to a regular disk drive in virtual implementations.
Application Inspection triggers are user-defined code that automatically executes on system events through the ExtraHop Trigger API. By writing triggers, you can collect custom metric data about the activities on your network. In addition, triggers can perform operations on protocol messages (such as an HTTP request) before the packet is discarded.
Triggers are a highly customizable and advanced feature. We recommend that you view the following documentation to learn about writing triggers to minimize disruption to your system performance.
- ExtraHop Trigger API Reference
- The Trigger section of the ExtraHop Web UI Guide
- The Packet Capture section of the ExtraHop Admin UI Guide
Thank you for your feedback. Can we contact you to ask follow up questions?