Admin UI Guide

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select the LDAP option and click Continue.

   Note:

   Clicking the back button in your browser during this procedure could result in lost changes.

3. On the LDAP Settings page, complete the following server information fields:
   1. Type the hostname or IP address of the LDAP server in the Hostname field. Make sure that the DNS entry of the ExtraHop appliance is properly configured if you type a hostname.
   2. Type the port number on which the LDAP server is listening in the Port field. Port 389 is the standard cleartext LDAP server port. Port 636 is the standard port for secure LDAP (ldaps/tls ldap).
   3. Select the type of LDPA server from the Server Type drop-down list. Select Posix or Active Direcrory.
   4. Type the bind DN in the Bind DN field. The bind DN is the user credentials that allow you to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers.

      Note:

      The standard login attribute for POSIX systems is uid. The standard login attribute for Active Directory systems is sAMAccountName.

   5. Type the bind password in the Bind Password field. The bind password is the password required when authenticating with the LDAP server as the bind DN specified above. If you are configuring an anonymous bind, leave this setting blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.
   6. Select on of the following encryption options from the Encryption drop-down list.
      • None. This options specifies the use of cleartext TCP sockets, typically port 389.

        Warning:

        All passwords are sent across the network in cleartext in this mode.

      • LDAPS. This option specifies LDAP wrapped inside SSL, typically on port 636.
      • StartTLS. This option specifies the use of TLS LDAP, typically on port 389. (SSL is negotiated before any passwords are sent.)
   7. Select Validate SSL Certificates to enable certificate validation. If you select this option, the certificate on the remote endpoint is validated against the root certificate chains specified by the trusted certificates manager. In addition, the host name specified in the certificate presented by the LDAP server must match the host name specified in your LDAP configuration or validation will fail. You must configure which certificates you want to trust on the Trusted Certificates page. For more information, see Add a trusted certificate to your ExtraHop appliance.
   8. Type a time value in the Refresh Interval field or leave the default setting of 1 hour. The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop appliance.
4. Configure the following user settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user accounts.
   3. Select one of the following options from the Search Scope drop-down list. Search scope specifies the scope of the directory search when looking for user entities.
      • Whole subtree. This option looks recursively under the base DN for matching users. For example, with a Base DN value of dc=example,dc=com, the search would find the user uid=jdoe,dc=example,dc=com and uid=jsmith,ou=seattle,dc=example,dc=com.
      • Single level. This option looks for users that exist in the base DN; not any subtrees. For example, with a Base DN value of dc=example,dc=com, the search would find a user uid=jdoe,dc=example,dc=com, but would not find uid=jsmith,ou=seattle,dc=example,dc=com.
5. To configure user group settings, select the Import user groups from LDAP server checkbox and configure the following settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for user groups. The base DN must contain all user groups that will have access to the ExtraHop appliance. The user groups can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user groups.
   3. Select one of the following options from the Search Scope drop-down list. Search scope specifies the scope of the directory search when looking for user group entities.
      • Whole subtree. This option looks recursively under the base DN for matching user groups.
      • Single level. This option looks for user groups that exist in the base DN; not any subtrees.
6. Click Test Settings. If the test succeeds, a status message appears near the bottom of the page. If the test fails, click Show details to see a list of errors. You must resolve any errors before you continue.
7. Click Save and Continue.

Determine whether you want to allow local or remote authentication.

1. Choose one of the following options from the Permission assignment options drop-down list:
   • Obtain permissions level from remote server

     If you want to obtain a permissions level from a remote server, select the Obtain permissions level from remote server option and complete at least one of the following fields to specify the remote permissions:

     • Full access DN
     • Read-write DN
     • Limited DN
     • Personal DN
     • Node connection privileges DN

       Note:

       This field is visible only on the Command appliance.

     • Read-only DN
     • Read-limited DN
     • Packet access full DN

     These fields must be groups (not organizational units) that are pre-specified on the LDAP Server. A user account with access must be a direct member of a specified group. User accounts that are a member of a group that is a member of a group specified above will not have access. If the groups are not present, they will not be authenticated on the ExtraHop appliance.

     The ExtraHop appliance supports the following types of group membership:

     • Active Directory: memberOf
     • Posix: posixGroups, groupofNames, and groupofuniqueNames
   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI. To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.

   • Remote users have read-only access
     This option allows remote users to have read-only privileges to the ExtraHop Web UI. To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

2. Click Save and Finish.
3. Click Done.

The ExtraHop appliance supports Remote Authentication Dial In User Service (RADIUS) for remote authentication and local authorization only. For remote authentication, the ExtraHop appliance supports unencrypted RADIUS and plaintext formats.

1. In the Access Settings section, click Remote Authentication.
2. Select RADIUS from the Remote authentication method drop-down, then click Continue.
3. On the Add RADIUS Server page, type the following information:

   Host

   The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you specify a hostname.

   Secret

   The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout

   The amount of time in seconds that the ExtraHop appliance waits for a response from the RADIUS server before attempting the connection again.

4. Click Add Server.
5. (Optional): Add additional servers as needed.
6. Click Save and Finish.
7. Choose one of the following options from the Permission assignment options drop-down list:
   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI.

   • Remote users have read-only access

     This option allows remote users to have read-only permissions to the ExtraHop Web UI.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

   • Remote users have command cluster access

     This option, which only appears on the Command appliance, allows remote users to log into the Admin UI on the Command appliance and view any connected Discover, Explore, and Trace appliances.

8. (Optional): To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.
9. Click Save and Finish.
10. Click Done.

The ExtraHop appliance supports Terminal Access Controller Access-Control System Plus (TACACS+) for remote authentication and authorization.

1. In the Access Settings section, click Remote Authentication.
2. In the Methods section, select TACACS+ from the Remote authentication method drop-down, then click Continue.
3. On the Add TACACS+ Server page, type the following information:

   Host: The hostname or IP address of the TACACS+ server. Make sure that the DNS of the ExtraHop appliance is properly configured if you are entering a hostname.

   Secret: The shared secret between the ExtraHop appliance and the TACACS+ server. Contact your TACACS+ administrator to obtain the shared secret.

   Timeout: The amount of time in seconds that the ExtraHop appliance waits for a response from the TACACS+ server before attempting to connect again.

4. Click Add Server.
5. (Optional): Add additional servers as needed.
6. Click Save and Finish.
7. Choose one of the following options from the Permission assignment options drop-down list:
   • Obtain permissions level from remote server

     This option allows remote users to obtain permission levels from the remote server.

     You must also configure the TACACS+ server with two attributes, one for the ExtraHop service and one for the permission level.

     1. For the Attribute, add service.
     2. For the Value, add extrahop.
     3. For the Attribute, add the permission level, such as readwrite.
     4. For the Value, add 1.

     For example, the following figure shows a configured permission level of readwrite.

     The following list shows the different permission levels and the access they provide to users.

     • setup = 1, which allows the user to create and modify all objects and settings on the ExtraHop Web UI and Admin UI
     • readwrite = 1, which allows the user to create and modify all objects and settings on the ExtraHop Web UI
     • limited = 1, which allows the user to create, modify, and share dashboards
     • readonly = 1, which allows the user to view objects in the ExtraHop Web UI
     • personal = 1, which allows the user to create dashboards for themselves and modify any dashboards that have been shared with them
     • limited_metrics = 1, which allows the user to view shared dashboards
     • packetsfull = 1, which allows the user to view and download packets for any of the above user permission levels
   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI.

   • Remote users have full read-only access

     This option allows remote users to have read-only permissions to the ExtraHop Web UI.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

   • Remote users have command cluster access

     This option, which only appears on the Command appliance, allows remote users to log into the Admin UI on the Command appliance and view any connected Discover, Explore, and Trace appliances.

8. (Optional): To allow remote users to view and download packet captures, select the Remote users can view and download packets checkbox.
9. Click Save and Finish.
10. Click Done.

You can configure one or more allowed origins or you can allow access to the ExtraHop REST API from any origin.

1. In the Access Settings section, click API Access.
2. In the CORS Settings section, specify one of the following access configurations.
   • To add a specific URL, type an origin URL in the text box, and then click the plus (+) icon or press ENTER.

     The URL must include a scheme, such as HTTP or HTTPS, and the exact domain name. You cannot append a path; however, you can provide a port number.

   • To allow access from any URL, select the Allow API requests from any Origin checkbox.

     Note:

     Allowing REST API access from any origin is less secure than providing a list of explicit origins.

3. Click Save Settings and then click Done.

You can delete a URL from the list of allowed origins or disable access from all origins.

1. In the Access Settings section, click API Access.
2. In the CORS Settings section, modify one of the following access configurations.
   • To delete a specific URL, click the delete (X) icon next to the origin you want to delete.
   • To disable access from any URL, clear the Allow API requests from any Origin checkbox.
3. Click Save Settings.

To exclude a protocol module from the network capture:

1. Click System Configuration > Capture.
2. Click Excluded Protocol Modules.
3. Add Module to Exclude.
4. On the Select Protocol Module to Exclude page, from the Module Name dropdown, select the module that you want to exclude from the capture.
5. Click Add.
6. On the Excluded Protocol Modules page, click Restart Capture.
7. After the capture restarts, click OK.

To re-include a previously excluded protocol module:

1. Click System Configuration > Capture.
2. Click Excluded Protocol Modules.
3. On the Excluded Protocol Modules page, click Delete next to the module name for each module you want to re-include.
4. Click Restart Capture.
5. After the capture restarts, click OK.

1. In the System Configuration section, click Capture.
2. Click MAC Address Filters.
3. Click Add Filter.
4. In the MAC Address field, type the MAC address to exclude.
5. In the Mask field, type the mask to indicate how many bits, from left to right, the filter checks against the MAC address.
6. Click Add.
   In the following example, the full MAC address is excluded from the capture:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:FF:FF:FF

   In this example, only the first 24 bits are evaluated for exclusion:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:00:00:00

1. Click System Configuration > Capture.
2. Click MAC Address Filters.
3. On the MAC Address Filters page, click Delete next to the MAC address filter for each address you want to re-include.
4. Click OK.

1. Click System Configuration > Capture.
2. Click IP Address Filters.
3. Click Add Filter.
4. On the IP Address Filters page, enter either a single IP address you want to exclude, or an IP address mask in CIDR format for a range of IP addresses you want to exclude.
5. Click Add.

1. Click System Configuration > Capture.
2. Click IP Address Filters.
3. On the IP Address Filters page, click Delete next to the IP address filter for each address you want to re-include.
4. Click OK.

1. Go to the Configuration section and click Capture.
2. On the Capture Configuration page, click Port Filters.
3. Click Add Filter.
4. On the Port Address Filters page, enter the port you want to include.
   • To specify a source port you want to exclude, enter the port in the Source Port field.
   • To specify a destination port you want to exclude, enter the port in the Destination Port field.
5. From the IP Protcol drop-down list, select the protocol you want to exclude on the indicated port.
6. Click Add.

1. Click System Configuration > Capture.
2. Click Port Filters.
3. On the Port Address Filters page, click Delete next to the port you want to re-include.
4. Click OK.

1. Click System Configuration > Capture.
2. Click Psuedo Devices.
3. Click Add Device.
4. On the Add Pseudo Devices page, enter the following information:

   IP Address

   The IP address range for the device in CIDR notation.

   IP Address/subnet prefix length

   For example, 10.10.0.0/16 for IPv4 networks or 2001:db8::/32 for IPv6 networks.

   MAC

   A dummy MAC address for the device.

1. Click System Configuration > Capture.
2. Click Psuedo Devices.
3. On the Pseudo Devices page, click Delete next to the pseudo device you want to remove from the list.
4. Click OK.

The following procedure describes how to add custom protocol classification labels using the TDS (MS SQL Server) protocol as an example. By default, the ExtraHop appliance looks for TDS traffic on TCP port 1533.

1. In the System Configuration section, click Capture.
2. Click Protocol Classification.
3. Click Add Protocol.
4. On the Protocol Classification page, enter the following information:

   Name

   From the drop-down, select Add custom label....

   Name

   Enter TDS for the custom protocol name.

   Protocol

   From the drop-down, select an L4 protocol to associate with the custom protocol (TCP in this example).

   Source

   The source port for the custom protocol. (The default value of 0 specifies any source port.)

   Destination

   The destination port for the custom protocol. To specify a range of ports, put a hyphen between the first and last port in the range. For example, 3400-4400.

   Loose Initiation

   Select this checkbox if you want the classifier to attempt to categorize the connection without seeing the connection open. ExtraHop recommends selecting loose initiation for long-lived flows.

   By default, the ExtraHop appliance uses loosely-initiated protocol classification, so it attempts to classify flows even after the connection was initiated. You can turn off loose initiation for ports that do not always carry the protocol traffic (for example, the wildcard port 0).

5. Click Add.
6. Confirm the setting change, and then click Restart Capture for the change to take effect. This will briefly interrupt the collection of data.
7. After the capture restarts, a confirmation message appears. Click Done.
8. This change has been applied to the running config. When you save the change to the running config, it will be reapplied when the ExtraHop appliance restarts. Click View and Save Changes at the top of the screen.
9. Click Save to write the change to the default configuration.
10. After the configuration is saved, a confirmation message appears. Click Done.

1. Click System Configuration > Capture.
2. Click Protocol Classification.
3. On the Protocol Classification page, click Delete next to the protocol that you want to remove from the list.
4. Click OK.
5. This change has been applied to the running config. When you save the change to the running config, it will be reapplied when the ExtraHop system restarts. Click View and Save Changes at the top of the screen.
6. Click Save to write the change to the default configuration.
7. After the configuration is saved, a confirmation message appears. Click Done.

Before you can decrypt forwarded traffic, you must upload the private keys that are associated with your SSL server certificate. The certificate and keys are uploaded over an HTTPS connection from a web browser to the Discover appliance.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the SSL Decryption Keys section, click Add Keys.
4. In the Add PEM Certificate and RSA Private Key section, enter the following information:

   Name

   A friendly name for the added key.

   Enabled

   Deselect this checkbox if you do not want to enable this SSL certificate.

   Certificate

   The public key certificate information.

   Private Key

   The RSA private key information.

5. Click Add.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the SSL Decryption Keys section, click Add Keys.
4. In the Add PKCS#12/PFX File With Password section, enter the following information:

   Description

   A friendly name for the added key.

   Enabled

   Deselect this checkbox if you don't want to enable this SSL certificate.

   PKCS#12/PFX

   Click Choose File and browse to the file, select it, and click Open.

   Password

   The password for the PKCS#12/PFX file.

5. Click Add.
6. Click OK.

1. Click System Configuration > Capture.
2. Click SSL Decryption.
3. In the Encrypted Protocols section, click Add Protocol.
4. On the Add Encrypted Protocol page, enter the following information:

   Protocol

   From the drop-down list, select the protocol you want to add.

   Key

   From the drop-down, select a previously set key.

   Port

   The source port for the protocol. By default this is set to 443, which specifies HTTP traffic.

5. Click Add.

1. Click System Configuration > Capture.
2. Click Open Data Context API.
3. On the Open Data Context API page, enter the following information:

   Enable Open Data Context API

   Check this checkbox to enable the Open Data Context API.

   TCP Port Enabled

   Check this checkbox to enable the TCP port for Open Data Context.

   TCP Port

   The port number of the enabled TCP port. By default, this is set to 11211.

   UDP Port Enabled

   Check this checkbox to enable the UDP port for Open Data Context.

   UDP Port

   The port number of the enabled UDP port. By default, this is set to 11211.

4. Click Save and Restart Capture.
5. Click OK.

The default session table size is 32768 entries. You can modify the running config to change the session table size, but increasing the session table size might impact memory consumption on the system and cause other issues. You must restart the capture to see these changes.

"jssession_table_size": 32768

1. Click System Configuration > Capture.
2. Click Network Overlay Decapsulation.
3. In the Settings section, select the Enabled checkbox next to NVGRE.
4. Click Save.

VXLAN is a UDP tunneling protocol is configured for specific destination ports. Decapsulation is not attempted unless the destination port in a packet matches the UDP destination port or ports listed in the VXLAN decapsulation settings.

1. Click System Configuration > Capture.
2. Click Network Overlay Decapsulation.
3. In the Settings section, select the Enabled checkbox next to VXLAN.
4. In the VXLAN UDP Destination Port text box, type a port number and click the green plus (+) .
   By default, port 4789 is added to the UDP Destination Port list. You can add up to eight destination ports.
5. Click Save.

You can download the running config file as a text file to your workstation. We recommend that you save a copy of this file in case of an unexpected system failure. The saved running config file can be uploaded to an ExtraHop appliance to restore system customizations and settings.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Appliance Settings section, click Running Config.
3. Click Download config as a file.

Management GUI setting controls the status of the Apache Web Server that runs the ExtraHop web interface application. By default, this service is enabled so that ExtraHop users have access to the ExtraHop Web UI and Admin UI. If this service is disabled, it terminates the Apache Web Server session, turning off web browser access to the ExtraHop UIs.

1. Click Appliance Settings > Services.
2. Select or clear the Management GUI checkbox.
3. Click Save.

The state of the network is monitored through the Simple Network Management Protocol (SNMP). SNMP collects information by polling devices on the network. SNMP agents can send alerts to SNMP managers. For example, you could configure an agent to determine how much free space is available on an ExtraHop appliance and send an alert if the appliance is over 95% full.

1. Enable or disable the SNMP service.
   1. In the Appliance Settings section, click Services.
   2. Select or clear the SNMP Service checkbox.
   3. Click Save.
2. Configure the SNMP service.
   The SNMP community string is an identifier that polls the SNMP service.
   1. On the Services page, next to SNMP Service, click Configure.
   2. On the SNMP Service Configuration page, enter the following information:

      Enabled

      Select the checkbox to enable the SNMP service.

      SNMP Community

      A friendly name for the SNMP community.

      SNMP System Contact

      A valid name or email address for the SNMP system contact.

      SNMP System Location

      A location for the SNMP system.

   3. Click Save Settings.

SNMP does not provide a database of information that an SNMP monitored network reports. SNMP uses information defined by third-party management information bases (MIBs) that describe the structure of the collected data.

1. Go to the Network Settings section and click Notifications.
2. Under Notifications, click SNMP.
3. Under SNMP MIB, click the Download ExtraHop SNMP MIB.
   The file is typically saved to the default download location for your browser.

The SSH Service setting controls the status of the Secure Shell protocol that manages the ExtraHop command-line interface (CLI). By default, this service is enabled so that ExtraHop users have access to the ExtraHop appliance functionality through the CLI. If this service is disabled, it terminates SSH, turning off CLI access to the ExtraHop appliance.

1. Click Appliance Settings > Services.
2. Select or clear the SSH Service checkbox.
3. Click Save.

The Admin UI provides access to the ExtraHop web shell by default. Click the Launch Shell button in the top right corner of the screen to launch the web shell.

1. Click Appliance Settings > Services.
2. Select or clear the Web Shell checkbox.
3. Click Save.

You must enable the session key receiver service on the Discover appliance before the appliance can receive and decrypt sessions keys from the session key forwarder. By default, this service is disabled.

1. Log into the Admin UI on the Discover appliance.
2. In the Appliance Settings section, click Services.
3. Select the SSL Session Key Receiver checkbox.
   If you do not see the checkbox, and you have purchased the SSL Decryption license, contact ExtraHop Support to update your license.
4. Click Save.

Firmware images that you want to upload must be accessible from the computer on which you are running the web browser.

1. In the Appliance Settings section, click Firmware.
2. Click Upgrade.
3. On the Upgrade Firmware page, select from the following options:
   • To upload firmware from a file, click Choose File, navigate to the .tar file you want to upload, and click Open.
   • To upload firmware from a URL, click retrieve from URL instead and then type the URL in the Firmware URL field.
   If the ExtraHop appliance has less than 300MB of space remaining, a warning message displays with a link to clean up the disk. We recommend that you perform a disk cleanup before uploading new firmware to ensure continued device functionality.
4. (Optional): If you do not want to automatically restart the appliance after the firmware is installed, clear the Automatically restart appliance after installation checkbox.
5. Click Upgrade.
   The ExtraHop appliance initiates the firmware upgrade. You can monitor the progress of the upgrade with the Updating progress bar.
6. After the firmware update is installed successfully, the ExtraHop appliance displays the version number of the new firmware on the Admin UI. Click Reboot to restart the system.

Firmware images that you want to upload must be accessible from the computer on which you are running the web browser.

1. In the Appliance Settings section, click Firmware.
2. Click Upgrade.
3. On the Upgrade Firmware page, enter the following information:
   • To upload firmware from a file, click Choose File, navigate to the .tar file you want to upload, and click Open.
   • To upload firmware from a URL, click Retrieve from URL instead and then in the Firmware URL field, type the URL.
   If the ExtraHop appliance has less than 300MB of space remaining, a warning message appears with a link to clean up the disk. ExtraHop strongly recommends performing a disk cleanup before uploading new firmware to ensure continued device functionality.
4. (Optional): To not automatically restart after installing the new firmware, clear the Automatically restart appliance after installation checkbox.
5. Click Upgrade.
   The ExtraHop appliance initiates the firmware update. You can monitor the progress of the update with the Updating progress bar.
6. After the firmware upgrade is installed successfully, the ExtraHop appliance displays the version number of the new. Click Reboot to restart the system.
7. After restarting, on the Admin UI main page, view the firmware information at the top right of the page.
8. Verify that the firmware version number displayed matches the version that you downloaded from the URL.

The ExtraHop appliance stores every firmware image that has been uploaded to the system. For maintenance purposes, these firmware images can be deleted from the system.

Before you can perform packet captures through triggers, you must first ensure you are licensed for packet capture on your ExtraHop appliance and your SSD is installed if you are not using a virtual machine.

1. In the Appliance Settings section, click License.
2. In the Features section, verify that packet capture is enabled. If you do not see Packet Capture in the list or Packet Capture is not listed as Enabled, contact ExtraHop Customer Support.

   Note:

   On a Discover virtual machine, the packet capture license is labeled Enabled (Unrestricted). This means the packet capture data will be written to a regular disk drive instead of an SSD.

3. Next, verify that the SSD is installed on your ExtraHop appliance. (This step is not applicable to virtual machines.)
4. In the Appliance Settings section, click Disks. If the Drive Map shows the last slot in red, refer to Disk to install and enable the drive.
5. If the Drive Map shows the SSD drive as green and the Status is Online, the disk is ready for packet capture.

   Note:

   If the SSD drive is dislodged and reinserted, you can re-enable it. This process requires reformatting the disk, which erases all data.

(Skip this section if you are doing a global packet capture.) The ExtraHop appliance uses Application Inspection Triggers to gather custom metrics. These metrics are stored internally and can be used by other features, such as packet capture. Triggers are user-specified scripts that perform additional actions during well-defined events.

1. Click the System Settings icon and then click Triggers.
2. Click New.
3. Type a name for the trigger and select the events that will activate the trigger. Then click the Editor tab and write your trigger source code.

   Note:

   After you have tested the trigger to ensure it works, clear the Enable Debugging checkbox to avoid excessive debug messages in the runtime log.

4. Assign the trigger to a device or group of devices.
5. Click Save.

You can configure global packet capture through the Admin UI to save every packet on every flow.

1. In the Packet Captures section, click Global Packet Capture.
2. In the Start Global Packet Capture section, type the following information:

   Name: The name for the capture.

   Max Packets: The maximum number of packets to capture. This value cannot be a negative number.

   Max Bytes: The maximum number of bytes to captures. This value cannot be a negative number.

   Max Duration (milliseconds): The maximum duration that the global capture should run. If this value is set to 0, this field is ignored and the duration runs for an unlimited time.

   Snaplen: The maximum number of bytes copied per frame. By default, this value is 96 bytes, but you can set this value to a number between 1 and 65535.

3. Click Start.
4. Click Stop to stop the packet capture before any of the maximum limits are reached.