Configure a Center DPI

Configure a Center DPI

This section describes how to configure a Center DPI, that is, a virtual sensor in the Center.

Requirements:

Make sure an ethernet interface is available for the Center DPI traffic, depending on:

  • If the server has a dual interface, that is, the Administration interface is on eth0 and the Collection interface is on eth1, then eth2 will be used for the Center DPI.

  • If the server has a single interface, that is, the Administration and Collection interfaces are on the same interface, then eth1 will be used for the Center DPI.

In the example below, the server has a single interface.

To configure a Center DPI:

Procedure

Step 1

Access the Cisco Cyber Vision sensors administration page.

Step 2

Open the Center shell prompt and type the following command:

sbs-netconf

Step 3

In the case of a single interface, select the eth1 interface.

In the case if a dual interface, select eth2.

Step 4

Select the interface as DPI+Snort port.

Step 5

Configure a capture filter mode. You can do that later in the Cisco Cyber Vision sensor page clicking the Capture mode button.

For more information on how to configure a capture mode filter, refer to the Cisco Cyber Vision GUI user guide.

For example, you can type "not arp".

In the Cisco Cyber Vision administration sensor page, the new virtual sensor appears and is ready to receive data.