Deploy an ExtraHop sensor on Hyper-V

1. Right-click the ExtraHop sensor VM and select Settings.
2. Expand Network Adapter and click Advanced Features.
3. In the Port mirroring section, click the Mirroring mode drop-down list and select Source.
4. Make note of the source network and ensure the capture interface on the ExtraHop VM is on the same network.
5. Click Apply.
6. Click OK.
7. Repeat these steps for all the VMs you want to monitor, excluding the first VM you created in this procedure.

This scenario requires a second physical network interface and the creation of a second vSwitch associated with that NIC. This NIC then connects to a mirror, tap, or aggregator that copies traffic from a switch. This setup is useful for monitoring the intranet of an office.

1. Right-click the ExtraHop sensor VM and select Settings.
2. Expand Network Adapter and click Advanced Features.
3. In the Port mirroring section, click the Mirroring mode drop-down list and select Destination.
4. Click Apply.
5. Click OK.
6. Expand the virtual switch associated with the external data feed and enable the Microsoft NDIS Capture switch. You can ignore the warning that the selected extension is not operating correctly.
   
7. Click Apply, and then click OK.
8. Start Windows PowerShell with administrator privileges.
9. Configure the external port of the virtual switch by running the following commands:
   1. Store the FeatureName parameter in a variable:

      $portFeature=Get-VMSystemSwitchExtensionPortFeature -FeatureName "Ethernet Switch Port Security Settings"
      

      Copy
   2. Change the monitor mode of the virtual switch to Source:

      $portFeature.SettingData.MonitorMode = 2

      Copy
   3. Add an external port to the virtual switch that includes the FeatureName parameter specified in step 9a:

      add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <name_of_switch> -VMSwitchExtensionFeature $portFeature

      Copy

      Where <name_of_switch> is the name of the virtual switch.

10. (Optional): To receive mirrored traffic from multiple VLANs, set the VM NIC to trunk mode and specify a list of allowed VLAN IDs by running the following command:

    Set-VMNetworkAdapterVlan -VMName <destination_vm> -Trunk -AllowedVlanIdList <id_list> -NativeVlanId <vlan_id>

    Copy

    Where <destination_vm> is the name of the ExtraHop VM, <id_list> is the list of allowed VLAN IDs, and <vlan_id> is the ID of the default VLAN.

    For example:

    Set-VMNetworkAdapterVlan -VMName EDA1100v -Trunk -AllowedVlanIdList 1-100 -NativeVlanId 10

    Copy

You must install the packet forwarder software on each server to be monitored to forward packets to the ExtraHop system.

You must install the packet forwarder software on each server to be monitored in order to forward packets to the ExtraHop system.

1. Download the RPCAP Service for Windows installer file from the ExtraHop Downloads and Resources web page.
2. Double-click the file to start the installer.
3. In the wizard, select the components to install.
   
4. Complete the ExtraHop IP and ExtraHop Port fields and click Next. The default port is 2003.
   
5. (Optional): Type additional arguments in the text box and click Next.
   
6. Browse to and select the destination folder to install RPCAP Service.
   
7. If RPCAP Service was previously installed, click Yes to delete the previous service.
   
8. When the installation is complete, click Close.

For servers with multiple interfaces, you can configure the packet forwarder to forward packets from a particular interface or from multiple interfaces by editing its configuration file on the server.

1. After installing the packet forwarder, open the configuration file, /opt/extrahop/etc/rpcapd.ini.
   The configuration file contains this text or similar:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   Note:

   Do not modify the NullAuthPermit or UserName fields.

2. Modify the existing ActiveClient line and create an ActiveClient line for each additional interface to be monitored. Specify each interface by its interface name or IP address.

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifname=<interface_name>

   Copy

   or

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifaddr=<interface_address>

   Copy

   Where <interface_name> is the name of the interface from which you want to forward packets, and <interface_address> is the IP address of the interface from which the packets are forwarded. The <interface_address> variable can be either the IP address itself, such as 10.10.1.100, or a CIDR specification (network IP address/subnet prefix length) that contains the IP address, such as 10.10.1.0/24.

   For every ActiveClient line, the packet forwarder independently forwards packets from the interface specified in the line.

   The following is an example of the configuration file specifying two interfaces by the interface name:

   ActiveClient = 10.10.6.45, 2003, ifname=eth0
   ActiveClient = 10.10.6.45, 2003, ifname=eth1
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   The following is an example of the configuration file specifying two interfaces by the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   The following is an example of the configuration file specifying two interfaces using CIDR specifications that contain the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
   NullAuthPermit = YES
   UserName = rpcapd

   Copy
3. Save the configuration file. Make sure to save the file in ASCII format to prevent errors.
4. Restart the packet forwarder by running the command:

   sudo /etc/init.d/rpcapd restart

   Copy

   Note:

   To reinstall the packet forwarder after changing the configuration file, run the installation command and replace <extrahop_ip> and <extrahop_port> with the –k flag in order to preserve the modified configuration file. For example: sudo sh ./install-rpcapd.sh –k Copy

For servers with multiple interfaces, you can configure the packet forwarder to forward packets from a particular interface or from multiple interfaces by editing its configuration file on the server.

1. After installing the packet forwarder on the server, open the configuration file: C:\Program Files\rpcapd\rpcapd.ini
   The configuration file contains this text or similar:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   Note:

   Do not modify the NullAuthPermit or UserName fields.

2. Modify the existing ActiveClient line and create an ActiveClient line for each additional interface to be monitored. Specify each interface by its interface name or IP address.

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifname=<interface_address>

   Copy

   Where <interface_address> is the IP address of the interface from which the packets are forwarded and <interface_address> can be either the IP address itself, such as 10.10.1.100, or a CIDR specification (network IP address/subnet prefix length) that contains the IP address, such as 10.10.1.0/24.

   or

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifaddr=<interface_name>

   Copy

   Where <interface_name> is the name of the interface from which the packets are forwarded. The name is formatted as \Device\NPF_{<GUID>}, where <GUID> is the globally unique identifier (GUID) of the interface. For example, if the interface GUID is 2C2FC212-701D-42E6-9EAE-BEE969FEFB3F, the interface name is \Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}.

   The following is an example of the configuration file specifying two interfaces with the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   The following is an example of the configuration file specifying two interfaces with CIDR specifications that contain the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
   NullAuthPermit = YES
   UserName = rpcapd

   Copy

   The following is an example of the configuration file specifying two interfaces with the interface name:

   ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
   ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{3C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
   NullAuthPermit = YES
   UserName = rpcapd

   Copy
3. Save the configuration (.ini) file. Make sure to save the file in ASCII format to prevent errors.
4. Restart the packet forwarder by running the following command:

   restart-service rpcapd

   Copy

   Note:

   To reinstall the packet forwarder software after changing the configuration file, run the installation command and replace -RpcapIp and -RpcapPort with the -KeepConfig flag to preserve the modified configuration file. For example: .\install-rpcapd.ps1 -MgmtIp <extrahop_ip> -KeepConfig Copy or .\install-rpcapd.ps1 –InputDir . -KeepConfig Copy

By default, the ExtraHop system accepts forwarded packets on port 2003. The servers using the software tap are directed to forward all traffic as denoted by the wildcard (*) in the Interface Address column.

1. Go to the RPCAP Settings section and click 2003.
2. Change and modify the settings on the Add RPCAP Port Definition page.

   Port

   Specifies the listening port on the ExtraHop system. Each port must be unique for each interface subnet on the same server. Different subnets across servers can be configured for the same port.

   Interface Address

   Specifies a subnet on the packet-forwarding server. If the server has multiple interfaces that match the interface address, the first interface on the server sends traffic to the ExtraHop system unless the interface name is specified.

   Interface Name

   Indicates the interface on the packet-forwarding server from which to forward packets.

   Note:

   You must specify an interface address or an interface name. If you specify both, then both criteria will apply.

   Filter

   Specifies the traffic to forward using Berkeley Packet Filter syntax. For example, TCP port 80 forwards only TCP traffic on port 80, and not TCP port 80 forwards only non-TCP traffic on port 80.

3. Click Save.

To find out how much wire data the ExtraHop system is receiving from the packet forwarder:

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address> and click the System Settings icon.
2. Click System Health to get more information about the forwarded traffic. This page displays a Packets and Throughput graph for each software tap connected to the ExtraHop system.
   

   The RPCAP Packets and Throughput graphs contain four metrics:

   Encapsulation

   The total number of RPCAP encapsulation packets received by the ExtraHop system.

   Tunnel Eligible

   Total number of packets eligible to be forwarded to the ExtraHop system.

   Tunnel Sent

   Total number of RPCAP-tunneled packets forwarded to the ExtraHop system.

   Tunnel Received

   Total number of RPCAP-tunneled packets received by the ExtraHop system.

   The tunnel eligible, tunnel sent, and tunnel received values are equal if the ExtraHop system is receiving and processing all the packets sent by the server. If the values are not equal, consider the following troubleshooting options:

   • If Tunnel Sent is less than Tunnel Eligible, the server is not able to forward all of the traffic. This behavior might indicate that packet forwarding requires more processing or outbound bandwidth resources on the server. Consider separating the forwarding process to a separate CPU or allocating a dedicated interface for forwarding traffic.
   • If Tunnel Received is less than Tunnel Sent, the ExtraHop system is not receiving all the traffic forwarded by the server. This behavior might be due to network congestion or insufficient resources on the ExtraHop system. If you suspect it is the latter, contact ExtraHop Support.
3. After you have verified that the ExtraHop system is receiving traffic, exit the System Health page and view metrics in the ExtraHop Web UI.

To remove the software from a Windows server or your Windows desktop:

1. Go to the Start Menu and select Control Panel.
2. Select Uninstall a program.
3. Select RPCAP Service for Windows.
4. In the pop-up dialog box, click Remove.
5. When the removal is complete, click Close.