Nepatech Troubleshooting

8/10/2019 Nepatech Troubleshooting

1/5

12/10/2014 IBM Security:IBM Security Intelli gence(QRadar/TSIEM/TSOM) :Network Surveill ance, Sentries & F lows:1301/1302 Flow Collectors - Testing/Verifyin

https ://w w w.i bm .c om /dev el oper w or ks /c om m uni ty /for um s/htm l /topi c?i d= 77777777- 0000- 0000- 0000- 000014969864

5 replies Latest Post - Apr 3, 2012 by SystemAdmin

SystemAdmin

117 Posts

F or um Dir ector y >IBM Secur ity >IBM Secur ity Intelligence( QRadar /T SIEM /T SOM ) >Networ k Sur veillance, Sentr ies & F lows >

1301/1302 F low Collector s - T esting/Ver ifying/T r oubleshooting the high speed ( napatech) m onitor ing

1301/1302 Flow Collectors -

Testing/Verifying/Troubleshooting the highspeed (napatech) monitoring cardsJul 16, 2010 | Tags: none

A few user s have asked for a m ethod to ver ify that the high speed ( Napatech) m onitor ing car ds

o n t h e i r 1 3 0 1 / 1 3 0 2 co l l e ctor s ar e connected, have link, and ar e getting data.

T he fir st way to quickly ver ify this, assum ing the collector is alr eady added as a m anaged host,

connected, and getting data, is to check the log file /var /log/qr adar .log for "qflow" m essages and

the pr esence of flow data.

T he next way is to use the included napatech tools located in /opt/napatech/bin/ to check the

car d settin g s .

Fir st you can use the "LinkT ool" to check the status of the por ts on the car d. Note that cur r ently

QRadar tr e ats the car d a s a s i n g l e sour ce, it does not differ entiate between the por ts in data

pr ocessing. T he following exam ple tests each por t and uses egr ep to just gr ab the lines for

v e r i f y i n g l i n k :

root@csd12 bin# for ports in 1 2 4 8 ; do ./LinkTool cmd Get cb 0x0$ports | egrep

"AdapterStatus|Link status|Link Speed"; done

AdapterStatus : Channel 0

Link status : not connected

Link Speed : (null)


Link status : connected

Link Speed : 100 Mbit



Link Speed : (null)



Link Speed : (null)

root@csd12 bin#

If you want to see the full details of a single car d, use the the com m and

"/opt/napatech/bin/LinkT ool - cm d Get - cb 0x01", r eplacing 0x01 with 0x02, 0x04 and 0x08 to get

por ts 1 to 4 r espectively.

root@csd12 bin# ./LinkTool cmd Get cb 0x02

LinkTool (v. 1.2.F 20100303094552)

==============================================================================


Link status : connected

Port type : SFP Copper 10/100/1000

Autonegotiation: enabled

Link quality : good

Link Speed : 100 Mbit

Duplex : Half

Forums Sear chT his F or um

Network Surveillance, Sentries & Flows Log in to particip

Topic Tags

Find a Tag

act ivat ion ac tivity analyt ics

apch e archit ect ure deployment

editor fl ows k ey logs mic

monit oring n e two r k open

qflow qradar r e m o v e

sie m utilization vf low

Cloud List

Sign in ( or r egister )E n g l i s hIBM

T e c hn ic a l t op ic s E va lu a ti on s o ft wa re C om mu n it y E ve n ts Search developerWorks

M y hom e F or um s B l o g s C o m m u n i t i e s Pr ofiles Podcasts Wikis Activities

IBM Cham pion pr ogr am
https://www.ibm.com/developerworks/community/forums/auth/redirecthttps://www.bluemix.net/?cm_mmc=dw-_-bluemix-_-dwcomm-_-bannerhttps://www.ibm.com/developerworks/community/podcasts/?lang=enhttps://www.ibm.com/developerworks/community/wikis?lang=enhttps://www.ibm.com/developerworks/community/activities/?lang=enhttps://www.ibm.com/developerworks/community/index.htmlhttp://www.ibm.com/developerworks/events/https://www.ibm.com/developerworks/dwwi/DWAuthRouter?m=loginpage&lang=en&d=https%3A%2F%2Fwww.ibm.com%2Fdeveloperworks%2Fcommunity%2Fforums%2Fhtml%2Ftopic%3Fid%3D77777777-0000-0000-0000-000014969864http://www.ibm.com/developerworks/https://www.ibm.com/developerworks/community/forums/html/category?id=a4c83a8c-1106-418e-bcae-323eb6641707https://www.ibm.com/developerworks/community/activities/?lang=enhttp://www.ibm.com/developerworks/http://-/?-https://www.bluemix.net/?cm_mmc=dw-_-bluemix-_-dwcomm-_-bannerhttps://www.ibm.com/developerworks/community/wikis?lang=enhttps://www.ibm.com/developerworks/community/forums/html/publichttps://www.ibm.com/developerworks/community/forums/html/category?id=33333333-0000-0000-0000-000000000528https://www.ibm.com/developerworks/champion/https://www.ibm.com/developerworks/community/podcasts/?lang=enhttps://www.ibm.com/developerworks/community/groups/?lang=enhttp://www.ibm.com/https://www.ibm.com/developerworks/community/homepage/?lang=enhttps://www.ibm.com/developerworks/community/forums/html/my?view=ownerhttps://www.ibm.com/developerworks/community/forums/auth/redirecthttps://www.ibm.com/developerworks/community/index.htmlhttps://www.ibm.com/developerworks/community/blogs/?lang=enhttp://www.ibm.com/developerworks/https://www.ibm.com/developerworks/community/forums/html/forum?id=11111111-0000-0000-0000-000000003044http://www.ibm.com/developerworks/downloads/http://www.ibm.com/developerworks/events/https://www.ibm.com/developerworks/dwwi/DWAuthRouter?m=loginpage&lang=en&d=https%3A%2F%2Fwww.ibm.com%2Fdeveloperworks%2Fcommunity%2Fforums%2Fhtml%2Ftopic%3Fid%3D77777777-0000-0000-0000-000014969864https://www.ibm.com/developerworks/community/forums/?lang=enhttps://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XKhttps://www.ibm.com/developerworks/community/profiles/?lang=enhttp://www.ibm.com/developerworks/topics/


2/5



Autonegotiation capabilities

10 MBit : Full duplex: Yes Half duplex: Yes

100 MBit: Full duplex: Yes Half duplex: Yes

1 GBit : Full duplex: Yes Half duplex: No

10 GBit : Full duplex: No Half duplex: No

Manual configuration capabilities

Full duplex: Yes

Half duplex: Yes

10 MBit : Yes

100 MBit : Yes

1 GBit : Yes

10 GBit : No

MDIMode : Auto: Yes MDI: Yes MDIX: Yes

Autonegotiation configuration for channelmask: 0x02

Autonegotiation enabled : Yes

Autonegotiation required: No

Cable detect : AutoMDI/MDIX

Advertise:

10 MBit : Full duplex: Yes Half duplex: Yes

100 MBit: Full duplex: Yes Half duplex: Yes

1 GBit : Full duplex: Yes Half duplex: No

10 GBit : Full duplex: No Half duplex: No

root@csd12 bin#

T he next com m and will show you byte and packet counts com ing into the inter faces as well.

root@csd12 bin# watch "/opt/napatech/bin/Statistics cb 0xFF | egrep 'Ch|Bytes'"

and the output ( r efr eshing with "watch") will look as follows

Every 2.0s: /opt/napatech/bin/Statistics cb 0xFF | egrep 'Ch|Bytes' Fri Jul 16 12:00:56 2010

Ch0: Packets=0x00000000 : Bytes=0x00000000000000 : Mbps= 0.00 : Util= 0.00

Ch1: Packets=0xEF5AE2D37 : Bytes=0x0013A38BB19E5A : Mbps= 0.01 : Util= 0.01







Note, that only por ts 0 thr ough 3 can be active. T he chipset on the Napatech car d suppor ts up

to 8 por ts, but only 4 ar e enabled on the car d that is used by the QRadar appliances.

Lastly, we also have a ver sion of tcpdum p com piled to wor k with the Napatech car ds, that can

be used to ver ify the data dir ectly on the car d. T his is located in the following locations:

7.0.0 ( Pr ovided) - /opt/napatech/bin

6.3.0/6.3.1 ( Download Link) - http://downloads.q1labs.com /tools/nt_tcpdum p.tar .gz

root@csd12 ~# wget http://downloads.q1labs.com/tools/nt_tcpdump.tar.gz

20100716 13:07:19 http://downloads.q1labs.com/tools/nt_tcpdump.tar.gz

Resolving downloads.q1labs.com... 69.20.57.57

Connecting to downloads.q1labs.com|69.20.57.57|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 374406 (366K) application/xgzip

Saving to: `nt_tcpdump.tar.gz'

100%======================================================================

================> 374,406 535K/s in 0.7s

20100716 13:07:19 (535 KB/s) `nt_tcpdump.tar.gz' saved 374406/374406

root@csd12 ~# tar zxf nt_tcpdump.tar.gz

root@csd12 ~# chmod 755 nt_tcpdump

root@csd12 ~#

T o use this utility, you m ust shutdown hostcontext on the appliance fir st.

root@csd12 ~# service hostcontext stop

[Q] Shutting down hostcontext service: OK

root@csd12 ~#

T hen, you need to load the napatech dr iver s m anually, list the inter faces, and r un the utility.

root@csd12 ~# /opt/napatech/bin/nt_tcpdump D

NT: ./pcapnapatech.c 167: Command NTCI_GetPacketFeedDescription failed: High level error 3 (low

level error 0x10000008)

1.eth0

2.eth1

3.eth2

4.eth3
http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/


3/5



5.any (Pseudodevice that captures on all interfaces)

6.lo

root@csd12 ~# /opt/napatech/bin/load_driver.sh ntxc0=/opt/napatech/config/ntpl.cfg

root@csd12 ~# /opt/qradar/bin/nt_tcpdump D

1.eth0

2.ntxc0:0 (NT adapter 0 feed 0)

3.eth1

4.eth2

5.eth3


7.lo

root@csd12 ~#

root@csd12 ~# /opt/qradar/bin/nt_tcpdump i ntxc0:0

nt_tcpdump: verbose output suppressed, use v or vv for full protocol decode

listening on ntxc0:0, linktype EN10MB (Ethernet), capture size 96 bytesnt_tcpdump: pcap_loop:

......

tcpdump output

......

5644 packets captured

5644 packets received by filter

0 packets dropped by kernel

root@csd12 ~#

If you need to captur e per channel, use the following syntax:

root@csd12 bin# /opt/napatech/bin/load_driver.sh ntxc0=/opt/napatech/config/ntpl_4feeds.cfg

root@csd12 bin# /opt/napatech/bin/nt_tcpdump D

1.eth0



4.ntxc0:2 (NT adapter 0 feed 2)5.ntxc0:3 (NT adapter 0 feed 3)

6.eth1

7.eth2

8.eth3


10.lo

root@csd12 ~# /opt/qradar/bin/nt_tcpdump i ntxc0:2 (channel 3)

nt_tcpdump: verbose output suppressed, use v or vv for full protocol decode

listening on ntxc0:2, linktype EN10MB (Ethernet), capture size 96 bytes

nt_tcpdump: pcap_loop:

......

tcpdump output

......

9321 packets captured

9321 packets received by filter

0 packets dropped by kernelroot@csd12 ~#

Once you' ve com pleted your testing, you need to unload the test napatech dr iver , r eload the

basic one, then r estar t hostcontext.

root@csd12 ~# /opt/napatech/bin/unload_driver.sh

Napatech Driver Load/Unload script (c) Napatech A/S

Part of package "nt_driver_linux_4.20.A" released 2010/03/05 10:42:29

Unloading driver D o n e

root@csd12 ~# service napatech start



Checking for Napatech presence on system D o n e

Loading configuration file /opt/napatech/config/default.cfg D o n e

Validating parsed driver options D o n eConfiguration parameters applied:

ReservedDMAPoolSize=16

Loading driver (this may take a while) D o n e

Running sanity checks D o n e

root@csd12 ~#

root@csd12 ~# service hostcontext start

[Q] Starting hostcontext service: OK

root@csd12 ~#

You could then m onitor the qr adar .log file to ensur e that the qflow pr ocess is able to pr oper ly

r e- open the napatech inter face.

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Initializing Packet Aggregator

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Adding flow source default_Netflow:3

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Adding flow source napatech0:14

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Initializing default_Netflow: 4895
http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/


4/5



SystemAdmin

117 Posts

SystemAdmin

117 Posts

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Initializing napatech0: 4896

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Starting default_Netflow: 4895

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Starting Flow Reporter: 4897

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO default_Netflow: Started UDP Socket. PORT = 2055

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO Starting napatech0: 4896

Jul 16 13:14:42 csd12 4 8 6 5 qflow0: INFO napatech0: Started

If you have any questions, feel fr ee to ask them in the com m ents section below.

d w i g h t s .

_______ ______ _______ ______ _______ ______

Q1 Labs Custom er Suppor t

- - - - - - - Posted BY dwight ( q1)

Log in to reply.

Updated on Apr 3, 2012 at 10:53 PM by SystemAdmin

Re: If you ever see the

Aug 19, 2011 in response to SystemAdmin

If you ever see the following:

1. service napatech start



Checking for Napatech presence on system D o n e

Loading configuration file /opt/napatech/config/default.cfg D o n eValidating parsed driver options D o n e

Configuration parameters applied:

OSTimeSync=1

ReservedDMAPoolSize=16

Loading driver (this may take a while) D o n e

Running sanity checks F a i l e d

~~~~~~ Er r or : Adapter 0 failed loading dr iver ~~~~~~~~~

DriverLog (v. 4.20.A 20100305104229)

========================================================================

======

DriverLog: LogLevel mask: 0x1

++

T im estam p | LogT ype | Log entr y

- - - - - - - - - - - -- - - - - - +- - - - - -- - - +- - - - - - - - - -- - - - - - - - - - - -- - - - - - - - - - - - -- - - - - - - -

4E4D2909.0009DB8A | #ERR | I2 er r or : Slave not r esponding.

4E4D2909.0009DB90 | #ERR | SDRAM : Could not r ead SPD. SDRAM m ight not

fittet cor r ect.

4E4D2909.0009DB95 | #ERR | NtM odulesInit: Init step 6 failed with

e r r o r c o d e 1 0 0 0 0 0 2 A

4 E 4 D 2 9 0 9 . 0 0 0 9 D B 9 A | # E R R | N t I n i t i a l i z e C a r d : F a i l e d t o i n i t i a l i z e

m o d u l e s

4 E 4 D 2 9 0 9 . 0 0 0 9 E 4 3 3 | # E R R | N t I n i t i a l i z e C a r d : F a i l e d i n i t i a l i z i n g

com m on inter faces - step 7: Result 1000002A

4E4D290A.000C028D | #ERR | NtStar tNic: Init step 4 failed with er r or

c o d e 1 0 0 0 1 0 0 1

You should shutdown the system and pull the napatech car d. T hen r eset the m em or y in the

car d. Page 16 of the attached pdf ( DN- 0248 NT 4E- 4- ST D Har dwar e Installation Guide.pdf) has

a p i c t u r e o f w h a t i t w o u l d l o o k l i k e .

Posted By Jay

Log in to reply.

Re: Incorrect output

Jan 18, 2012 in response to SystemAdmin

When you r un this com m and with a gigabit inter face, the statistics don' t display the tr ue

thr oughput:

watch "/opt/napatech/bin/Statistics - cb 0xF F - dec | egr ep ' Ch|Bytes' "

It m ight wor k when the inter face is 100m bps, but not gig.
http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://-/?-https://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XKhttp://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/https://www.ibm.com/developerworks/community/forums/auth/redirecthttp://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/https://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XKhttp://-/?-http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/http://www.ibm.com/developerworks/forums/https://www.ibm.com/developerworks/community/forums/auth/redirecthttp://www.ibm.com/developerworks/forums/


5/5



SystemAdmin

117 Posts

SystemAdmin

117 Posts

SystemAdmin

117 Posts

Feed for this topic

About

Help

Contact us

Submit content

Feeds

Newsletters

Report abuse

Terms of use

Third party notice

IBM privacy

IBM accessibility

Faculty

Students

Business Partners

Posted By pulse

Log in to reply.

Re: Gig napatech

Feb 23, 2012 in response to SystemAdmin

Is ther e any way to pr ovide the r eal thoughput with gig car ds? this com m and does not wor k as

m entionned befor e.

Posted By etor r eblanca

Log in to reply.

Re: What do you mean by real

Feb 23, 2012 in response to SystemAdmin

What do you m ean by r eal thr oughput?

T he tool deliver s in m y case som e data and it actually looks like the data I see on the switch

por t, which m eans for m e the thr oughput is cor r ect? Am I m issing som ething?

Her e is the output of the tool:

/opt/napatech/bin/Statistics - cb 0xf - dec - inter active

which will give you exact statistics including er r or counter s, I don' t know if you can r un it only on

1 por t on the napatech but it was easy to identify which of the 4 it was, by r em oving the cables.

It is also showing the M bps on each of the por ts.

Statistics ( v. 1.4.A - 2011- 01- 27- 16- 27- 44)

=========================================================================

=====

RX statistics:

Ch0: Packets=0x5EF C18ED : Bytes=0x0000CAC5F 8A3EA : M bps= 551.53 : Util= 55.15

Ch1: Packets=0x130DD47A : Bytes=0x00002F 65DB5453 : M bps= 127.64 : Util= 12.76

Ch2: Packets=0x00000000 : Bytes=0x00000000000000 : M bps= 0.00 : Util= 0.00

Ch3: Packets=0x00000000 : Bytes=0x00000000000000 : M bps= 0.00 : Util= 0.00

Posted By pat

Log in to reply.

Re: The command listed in the

Apr 3, 2012 in response to SystemAdmin

T he com m and listed in the beginning of the thr ead

watch "/opt/napatech/bin/Statistics - cb 0xF F | egr ep ' Ch|Bytes' "

doesn' t output the cor r ect r esults for gigabit inter faces. T he com m and you listed does

/opt/napatech/bin/Statistics - cb 0xf - dec - inter active

T hanks!

Posted By pulse

Log in to reply.
http://www.ibm.com/developerworks/aboutdw/contacts.htmlhttps://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XKhttps://www.ibm.com/developerworks/community/terms/thirdparty/http://www.ibm.com/developerworks/university/students/http://www.facebook.com/developerworkshttp://www.ibm.com/developerworks/newsletter/http://-/?-https://www.ibm.com/developerworks/community/terms/https://www.ibm.com/developerworks/community/report/http://-/?-http://twitter.com/developerWorkshttp://www.ibm.com/developerworks/aboutdw/http://www.ibm.com/accessibility/https://www.ibm.com/developerworks/feedbackhttp://www.ibm.com/developerworks/university/academicinitiative/http://-/?-https://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XKhttps://www.ibm.com/developerworks/community/forums/auth/redirecthttps://www.ibm.com/developerworks/ideashttps://www.ibm.com/developerworks/community/forums/auth/redirecthttps://www.ibm.com/developerworks/community/forums/auth/redirecthttp://www.ibm.com/developerworks/feeds/https://www.ibm.com/developerworks/community/forums/atom/replies?topicUuid=77777777-0000-0000-0000-000014969864http://www.ibm.com/isv/https://www.ibm.com/developerworks/community/forums/auth/redirecthttp://www.ibm.com/privacy/https://www.ibm.com/developerworks/community/profiles/html/profileView.do?userid=110000D4XK

Nepatech Troubleshooting

Documents

Transcript of Nepatech Troubleshooting