Configure RPCAP for a Trace Appliance

The following steps outline the key procedures that are required to implement RPCAP with an ExtraHop Trace appliance.

1. First, configure the Trace appliance to accept RPCAP traffic and add packet-forwarding rules.
2. Next, download the rpcapd software for the Discover appliance that applies to your remote devices. (Linux and Windows are both supported.)
3. Next, install the rpcapd software on every Linux or Windows device that you want to forward traffic from. You must modify the configuration file (rpcapd.ini) to specify device interfaces or to direct traffic to the Discover appliances.
4. Finally, If your environment has a firewall, open ports on your firewall for the requisite RPCAP traffic.

You can configure RPCAP and management on the same interface, but you might want to configure a second interface only for RPCAP to avoid unnecessary performance degradation.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Connectivity.
3. Select interface 1, 2, 3, or 4.
   The EDA 1000v and ETA 1150v only have interfaces 1 and 2.
4. From the Interface Mode drop-down list, select Management Port + RPCAP/ERSPAN/VXLAN Target.
5. DHCPv4 is enabled by default. If your remote devices do not support DHCP, you can disable DHCP and configure a static IP address. Or, you can click on IPv6 to configure your IP address through DHCP or through a static IP address or range on an IPv6 network. Make sure the management interfaces are not configured with overlapping subnets.
6. Click Save.

After you configure the interface as an RPCAP target, you must configure packet-forwarding rules. Packet forwarding rules limit what traffic is allowed to be sent to the ExtraHop system through RPCAP.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Connectivity.
3. In the RPCAP Settings section, complete one of the following actions:
   • Click on 2003 to open the default entry.
   • Click Add to add a new entry.

     Important:

     Port numbers must be 1024 or greater.

4. In the Add RPCAP Port Definition section, complete the following information:
   1. In the Port field, type the TCP port that will communicate information about this packet forwarding rule. Port entries must be unique for each interface subnet on the same server.
   2. In the Interface Address field, type the IP address or CIDR range of the interface on the device that you want the ExtraHop system to receive traffic from. For example, 10.10.0.0/24 will forward all traffic on the system that is part of that CIDR range, * is a wildcard that will match all traffic on the system, or 10.10.0.5 will only send traffic on the interface that matches the 10.10.0.5 IP address.

      Note:

      If a machine has multiple interfaces, and you do not specify an interface in the traffic rules or the rpcapd.ini file, the ExtraHop system will pick a single interface to forward traffic from. The ExtraHop system usually picks the interface with the name that comes first alphabetically. However, we recommend that you specify the interface in the traffic rules to ensure consistent behavior. We also recommend that you select the interface by address, rather than name.

   3. In the Interface Name field, type the name of the interface on the device that will send traffic to the ExtraHop system. For example, eth0 in a Linux environment or \Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F} in a Windows environment.
   4. In the Filter field, type the ports for the traffic that you want to forward to the ExtraHop system in Berkeley Packet Filter (BPF) syntax. For example, you can type tcp port 80 to forward all traffic on TCP port 80 from your remote network device to the ExtraHop system. For more information about BPF syntax, see Filter packets with Berkeley Packet Filter syntax.
5. Click Save, which saves the settings and restarts the capture.
6. Repeat these steps to configure additional rules. You can add up to 16 rules.

After you configure the interface and configure packet forwarding rules, you must save the changes to the running configuration file.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Connectivity.
3. Click View and Save Changes.
4. Review the changes in the Current running config (not yet saved) pane.
5. Click Save.
6. Click Done.

Complete the following steps to begin sending packets to the Trace appliance from remote Linux devices.

1. Open the rpcapd configuration file (/opt/extrahop/etc/rpcapd.ini) in a text editor. The configuration file contains text similar to the following example:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES

   Copy
2. Add another ActiveClient entry to the end of the file with the IP address of your Trace appliance and the lowest port that your Discover appliance is configured with. In the following example, the IP address for the Discover appliance is 10.0.0.100 and the IP address for the Trace appliance is 10.1.20.1, and both appliances are listening on TCP port 2003.

   ActiveClient = 10.0.0.100,2003
   ActiveClient = 10.1.20.1,2003
   NullAuthPermit = YES

   Copy
3. After editing the configuration (rpcapd.ini) file, restart the RPCAP process.

Complete the following steps to begin sending packets to the Trace appliance from remote Windows devices.

1. Open the rpcapd configuration file (C:\Program Files\rpcapd\rpcapd.ini).The file contains text similar to the following:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES

   Copy
2. Add another ActiveClient entry to the end of the file with the IP address of your Trace appliance and the lowest port that your Discover appliance is configured with. In the following example, the IP address for the Discover appliance is 10.0.0.100 and the IP address for the Trace appliance is 10.1.20.1, and both appliances are listening on TCP port 2003.

   ActiveClient = 10.0.0.100,2003
   ActiveClient = 10.1.20.1,2003
   NullAuthPermit = YES

   Copy
3. After editing the configuration (rpcapd.ini) file, restart the rpcapd process.