Administration of QRadar Network Packet Capture

You must make sure that you are logged in as an administrator when you perform packet capture tasks.

QRadar Network Packet Capture user accounts and authentication setup
User authentication on the QRadar® Network Packet Capture appliance is a two-stage process. When a user tries to log in, authentication is done locally. If authentication fails, the user is authenticated against any configured Active Directory or Lightweight Directory Access Protocol (LDAP) server. If both types of authentication fail, the user is not granted access.
Data consistency check during startup
Stored data is checked for integrity and consistency during the startup of the IBM® QRadar Network Packet Capture appliance.
Configuring date and time
To ensure that captured data is time-stamped correctly, you must configure the date and time that QRadar Network Packet Capture uses. You can configure a local date and time for QRadar Network Packet Capture, or you can enable Network Time Protocol (NTP) or Precision Time Protocol (PTP) to synchronize the date and time from an external source.
Configuring a location name and contact
To make it easier to identify the QRadar Network Packet Capture appliance, ensure that you give it a recognizable name.
Starting or stopping packet capture
You can control the number of recordings your appliance captures.
Configuring the remote syslog setup
Use the REMOTE SYSLOG SETUP widget to enable remote system logging and to configure protocol details.
SNMP setup configuration
Use the SNMP SETUP widget to set up SNMP for the QRadar Network Packet Capture appliance.
X509 configuration
Use the X509 SETUP widget to install a new X509 certificate that is used by HTTPS to authenticate the IBM QRadar Network Packet Capture appliance.
Configuring the SmartNIC
Use the SMARTNIC SETUP widget to configure SmartNIC port settings, packet processing, and prefilters.
Setting up local retransmission
By locally retransmitting traffic you can send any packet received on one network interface (a physical port) to one or more network interface. For example, you can retransmit all packets received on port 1 to port 2.
Clearing statistics or searches
Use the CONTROL widget to clear all ongoing and queued searches.
Restarting the appliance and performing a factory reset
Use the CONTROL widget to access the QRadar Network Packet Capture power settings.
Enabling remote login by using SSH
You can restrict SSH access to specific IP addresses by configuring the SUPPORT LOGIN (SSH) widget. This capability provides specific users with remote root-level access to the system, which is useful for advanced troubleshooting and debugging.
Verify that the QRadar Network Packet Capture appliance is working
Check the user interface, or view the SmartNIC LEDs on the back of the appliance to verify that the appliance is functioning correctly.