Start Demo

Configure IP address discovery through TTL values

Sensors that are configured for L2 discovery and that have limited means for sharing device IP addresses (such as traffic without ARP, DHCP, or local multicast/broadcast addresses) can discover IP addresses through TTL values.

By adding a field to the running configuration file, you can enable the ExtraHop system to learn IP addresses for devices through packets with well-known time-to-live (TTL) values. These values indicate that the packet was not routed, which means that the ExtraHop system can reasonably identify an IP address assigned to an L2 device. We only recommend enabling this setting when other IP address discovery methods are unavailable.

  1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Appliance Settings section, click Running Config.
  3. Click Edit config.
  4. Add an entry to the running configuration file by completing the following steps:
    1. Add a comma after the second to last curly brace (}).
    2. Press ENTER to create a new line.
  5. Paste the following code on the new line before the final curly brace: 
    "capture": {
        "device_l2_cache_ip_ttl": true,
    }
  6. Click Update.
  7. Click Done.
  8. Click Save config and then click Save.
Last modified 2024-08-07