Setting up local retransmission

By locally retransmitting traffic you can send any packet received on one network interface (a physical port) to one or more network interface. For example, you can retransmit all packets received on port 1 to port 2.

About this task

Insert the QRadar® Network Packet Capture appliance between an existing network tap and any network device. By enabling local retransmit you can receive all traffic into the QRadar Network Packet Capture appliance and also forward all traffic to the connected network device.

Retransmission of a packet does not affect the capture of the packet.

The QRadar Network Packet Capture appliance retransmits traffic to the selected ports.

Procedure

  1. When the devices are connected, log in to the QRadar Network Packet Capture appliance as an administrator and click the ADMIN tab.
  2. Scroll to the SMARTNIC SETUP widget.
  3. For each port connected to the network tap, select the relevant ports connected to the analysis appliance or appliances.
    Select either of these options for the port:
    • Local retransmit
    • Retransmit ETS: A timestamp is appended to every packet in the session.
  4. Click Apply.