The purpose of this document is to show Immediate Insight users how to configure additional network interfaces from the command line.

Caution:  If you connect both eth0 and eth1 to the same network/switch this will cause a bridge loop & connectivity problems, they must be on separate networks / subnets.

One use case would allow for a management and data networks to be on a different subnet.

  1. Connect to the CLI of the Immediate Insight instance using Putty or your terminal emulator of choice.
  2. Edit the following files adding the lines show below.
    1. /etc/network/interfaces
      1. iface eth1 inet static = (static IP configuration, e.g.)
        • address
        • gateway
        • netmask
      2. iface eth1 inet dhcp = (DHCP IP configuration)
    2.  /etc/rc.local
      1. ifconfig eth1 up
  3. Run the command ‘sudo reboot’

Another use case is would be to use eth1 as a promiscuous mode packet listener without an IP address.  Edit the files below adding the lines indicated.

  1. /etc/network/interfaces
    • iface eth1 inet manual      (this forces it to have no IP address)
  2. /etc/rc.local
    • ifconfig eth1 up
    • ifconfig eth1 promisc
  3. Then ‘sudo reboot’

** below is Immediate Insight configuration for a packet listener command, making use of the eth1 promisc port**

Edit the Packet Capture command in DataFlow -> Remotes to assign the eth1 interface. Do this by adding the –i eth1 to the command string (the default is eth0)

(echo ‘@@sourceFile:tsharktag’; sudo tshark -i eth1 -b filesize:5000 -b files:5 -w /tmp/tsjunk -t ad -T fields -e frame.number -e col.Time -e col.Source -e col.Destination -e col.Protocol -e col.Length -e col.Info -E header=n -E separator=, -E quote=d ‘not(host @@agentIP)’) |nc @@serverIP 3003;sudo rm /tmp/tsjunk*