Question & Answer
Question
Why does DPI (Deep Packet Inspection) get reenabled after manually disabling it on QRadar Network Security (XGS) sensors?
Answer
When you disable DPI from the CLI, there are certain actions that can trigger it to become active again. Generally speaking, any action that would cause the alpsd service to restart causes DPI to become reenabled.
Below is a list of actions that causes DPI to be reenabled:
Below is a list of actions that causes DPI to be reenabled:
- Manually restarting the packet processing service from the CLI
- An XPU update (manual or auto-update)
- Policy changes that lead to packet processing service to restart. See Technote 1959239: Packet delay or loss while making changes to XGS policies for more information on this.
- Firmware upgrade
- Rebooting XGS
[{"Product":{"code":"SSFSVP","label":"IBM QRadar Network Security"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Command Line Interface (CLI)","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSHLHV","label":"IBM Security Network Protection"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"Command Line Interface (CLI)","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.3.2;5.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
24 January 2021
UID
swg21990297