325
edits
No edit summary |
Remco.derooy (talk | contribs) mNo edit summary |
||
Line 1: | Line 1: | ||
This guide describes how the Allegro Network Multimeter Virtual Edition can be set up with VMWare ESXI. The Allegro Virtual Edition is designed for 2 use cases. It can analyze [[Parallel packet processing|pcap captures]] or [[Ring Buffer Configuration Guide|packet ring buffers]] of unlimited size for forensic investigation or it can analyze live traffic from virtual machines by a virtual Mirror Port or [[ERSPAN Installation|ERSPAN]]. | This guide describes how the Allegro Network Multimeter Virtual Edition can be set up with VMWare ESXI. | ||
The Allegro Virtual Edition is designed for 2 use cases. | |||
# It can analyze [[Parallel packet processing|pcap captures]] or [[Ring Buffer Configuration Guide|packet ring buffers]] of unlimited size for forensic investigation and/or | |||
# it can analyze live traffic from virtual machines by a virtual Mirror Port or [[ERSPAN Installation|ERSPAN]]. | |||
== General == | == General == | ||
Line 5: | Line 10: | ||
=== DISCLAIMER === | === DISCLAIMER === | ||
Be aware that an activated ring buffer can degrade the I/O performance for all VMs. It is recommended to use one or more dedicated HDDs or SSDs for the ring buffer to prevent side effects | Packet analysis is resource intensive. Running the Allegro Packets VM on your own hardware and its performance outcome is warranted “as is”. Our support will be limited. | ||
Be aware that an activated ring buffer can (heavily) degrade the I/O performance for all VMs. It is strongly recommended to use one or more dedicated HDDs or SSDs for the ring buffer, to prevent side effects on other VMs. | |||
=== System requirements === | === System requirements === | ||
Line 45: | Line 52: | ||
[[File:Esxi create new vm step 2.png|600px]] | [[File:Esxi create new vm step 2.png|600px]] | ||
Select your data storage for the Allegro. This storage will be used as the boot partition and to store the configuration of the Allegro Virtual Edition | Select your data storage (20 GB is enough) for the Allegro. This storage will be used as the boot partition and to store the configuration of the Allegro Virtual Edition. | ||
This partition/disk will NOT ficilitate the packet ring buffer functionality. This does not require a high-speed disk. | |||
[[File:Esxi create new vm select storage.png|600px]] | [[File:Esxi create new vm select storage.png|600px]] | ||
Line 60: | Line 69: | ||
[[File:Esxi import.png|600px]] | [[File:Esxi import.png|600px]] | ||
== Packet ring buffer and pcap storage == | |||
You can add one or multiple virtual disks to the Allegro Virtual Edition. | |||
When powered off, press “Edit” in the Vmware ESXi host and add a new HDD. | |||
[[File:Esxi add hdd.png]] | |||
If done, you can enable the packet ring buffer as described in [[Ring Buffer Configuration Guide]]. | |||
Please note that a real-time capture of packets require high write rates to your storage device. Please use dedicated disks for the ring buffer to avoid performance issues on other virtual machines. | |||
=== Install USB License dongle === | === Install USB License dongle === | ||
Line 108: | Line 128: | ||
[[File:Esxi switch allow promicuous mode.png|900px]] | [[File:Esxi switch allow promicuous mode.png|900px]] | ||
== Encapsulated remote mirroring (L3) source == | == Encapsulated remote mirroring (L3) source == | ||
The Allegro Virtual Edition supports the VMware '''Encapsulated remote mirroring (L3) source''' with the [[ERSPAN Installation|ERSPAN Mode]]. You can set up an IP address on the capture port and send encapsulated packets to the Allegro. Please see the Vsphere documentation center for Encapsulated remote mirroring (L3) source. | The Allegro Virtual Edition supports the VMware '''Encapsulated remote mirroring (L3) source''' with the [[ERSPAN Installation|ERSPAN Mode]]. You can set up an IP address on the capture port and send encapsulated packets to the Allegro. Please see the Vsphere documentation center for Encapsulated remote mirroring (L3) source. |
edits