AppResponse Xpert RPM Integration Version 2 Getting Started Guide

AppResponse Xpert RPM Integration Version 2 Getting Started Guide RPM Integration provides additional functionality to the Riverbed OPNET AppResponse Xpert real-time application performance monitoring solution. AppResponse Xpert with RPM Integration creates a single, integrated appliance that provides a complete picture of how applications are performing and where delay is occurring whether it s at the end user, on the network, or across multi-tier applications. RPM Integration accelerates troubleshooting with streamlined workflows and deeper network insight, including: Application-specific analysis: CIFS, FIX, VDI (VMware PCoIP, Citrix ICA and CGP), HTTP, VoIP (SIP, Skinny, H.323), and SQL Address management protocols: DHCP, DNS Network layer analysis: ARP, microburst view and alerting Multi-segment analysis To use RPM Integration, you need to download and install the RPM Integration patch on the AppResponse Xpert appliance. This patch provides two features: Shark Module, which supports analysis of AppResponse Xpert packets using Cascade Pilot 10.5 or later. This feature requires an additional Shark Module license. For information about purchasing this license, contact your Riverbed sales representative. Flow export to Profiler, which supports analysis of AppResponse Xpert flow records in Cascade Profiler 10.0.7 or later. This functionality does not require an additional license. This document describes how to install, configure, and use RPM Integration. The following topics are discussed: Important Notes on page ARX-1-2 Licensing Requirements on page ARX-1-9 System Requirements on page ARX-1-10 RPM Integration Setup on page ARX-1-12 Cascade Pilot: Viewing AppResponse Xpert Data on page ARX-1-15 Cascade Profiler: AppResponse Xpert Flow Export to Profiler on page ARX-1-23 AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-1

Important Notes Cascade Profiler: AppResponse Xpert Flow Export to Profiler on page ARX-1-23 Shark Command Reference on page ARX-1-26 What s New in 8.6 RPM Integration Getting Started Guide on page ARX-1-28 Note the following: Use an Accurate NTP Server for both Profiler and AppResponse Xpert Appliances Check Appliance Health Before You Run RPM Integration If "Analyze In > Cascade Pilot" Right-Click Menu Item Does Not Appear, Specify Binary Path or Re-Install Cascade Pilot as Administrator To View Packets Captured Before RPM Integration v2 was Installed, Save the Packets to a Trace or PCAP File Avoid Multiple Simultaneous Packet Operations on the Appliance Microflow Indexing is Enabled by Default You Cannot Lock Trace Clips on AppResponse Xpert Appliances Use an Accurate NTP Server for both Profiler and AppResponse Xpert Appliances To ensure accurate traffic flow records from Cascade Profiler, synchronize both the Cascade Profiler and the AppResponse Xpert appliance to an accurate NTP server, as described in step 1 of Procedure 1-3 on page ARX-1-23. Check Appliance Health Before You Run RPM Integration RPM Integration processes can be highly resource-intensive. Therefore, it is good practice to check utilization loads on the appliance using the Appliance Health Check insight. You should check the appliance using this insight before you install the Shark Module license and then periodically thereafter. You can install the Appliance Health Check insight from the Java console > Insights > Update Center > support.opnet.com/ace_live/insights/support > Tools. ARX-1-2 AppResponse Xpert/Release 8.6 712-00199-01

Riverbed recommends the following workflow for checking utilization loads on the appliance: 1) Run the Appliance Health Check insight (Insights > Support > Appliance Health Check). You can install this insight from the Java console > Insights > Update Center > support.opnet.com/ace_live/insights/support > Tools. Make sure that you have version 1.0.20 or higher installed on the appliance. 2) Set the Insight Time to the most recent week. 3) In the Packet Rate after Deduplication time series chart (middle), select the highest-traffic time window by dragging horizontally. The Key Performance Metrics table updates to show results for the time window when traffic was highest. If all performance metrics pass the performance check (green state), you should have no problems running RPM Integration on the appliance. If any metrics do not pass the Performance Check (yellow or red state), fix the problem as indicated in the insight help (click on the metric row in the Performance Metrics table). If "Analyze In > Cascade Pilot" Right-Click Menu Item Does Not Appear, Specify Binary Path or Re-Install Cascade Pilot as Administrator If you do not see the Analyze In > Cascade Pilot right-click menu option in the AppResponse Xpert console, even if Cascade Pilot 10.5 (or later) is installed, this could indicate that AppResponse Xpert does not detect the Cascade Pilot binaries directory. To resolve this issue, try either of the following. Specify the Cascade Pilot binaries path in AppResponse Xpert: a) In Cascade Pilot, click the About button in the upper-right corner of the main window. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-3

b) In the About Cascade Pilot window, click the Logs/Configurations tab. The Program Folder line shows the software binaries directory for Cascade Pilot. c) In the AppResponse Xpert console, choose Tools > Preferences and click the Cascade Pilot tab. d) Click the Select Application radio button. In the Bin Directory field, enter the full binary path (for example, C:\Users\yourname\AppData\Local\Apps\Riverbed\Cascade Pilot 10.5). Re-install Cascade Pilot 10.5 (or later) as Administrator for All Users: ARX-1-4 AppResponse Xpert/Release 8.6 712-00199-01

This will ensure that the AppResponse Xpert software detects the Cascade Pilot binaries path automatically. Do the following: Make sure that you are logged in to the local host as a user with Administrator privileges. Right-click on the installer icon and choose Run as Administrator. In the initial Cascade Pilot setup screen, make sure that Install for All Users is selected. To View Packets Captured Before RPM Integration v2 was Installed, Save the Packets to a Trace or PCAP File This release has limited support for retrospective analysis on pre-v2 packets that is, packets in the buffer that were captured before RPM Integration v2 was installed. To analyze pre-v2 packets in Cascade Pilot, you must save the packets to a trace file on your local host or to a PCAP file on the appliance. Note the following: You cannot use Cascade Pilot to analyze pre-v2 packets in capture jobs or trace clips. You cannot create a PCAP file on the appliance that is larger than 20GB in size. You also cannot store more than 50 GB of Pilot trace data on the appliance. If you exceed either of these thresholds, you will see a Quota Exceeded message when you try to analyze the packets. For this reason, it is good practice to Exclude as many irrelevant packets as possible from your Cascade Pilot analysis. Delete old Pilot traces from the appliance to free up disk space. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-5

Avoid Multiple Simultaneous Packet Operations on the Appliance When you want to do multiple packet operations in AppResponse Xpert and/or Cascade Pilot, do the operations in as sequential, one-at-a-time manner as possible. In this context, a packet operation is any operation that searches, retrieves, or otherwise accesses raw packets (rather than Microflow Index data) stored on the AppResponse Xpert appliance. Known Issue RPM Integration v2 has a known issue in which performing more than two of the following actions concurrently can result in various errors when the appliance tries to retrieve packets: In AppResponse Xpert: Analyze In Cascade Pilot preview operations that cannot use Microflow Index data Packet Download Manager preview/download In Cascade Pilot: Applying views to trace clips that lack Microflow Index data Saving trace clips as files Sending packets to AppTransaction Xpert or Wireshark Symptoms Error messages such as the following indicate that the appliance is having trouble processing concurrent packet tasks: Unable to retrieve preview data. The server is busy, please try again! (AppResponse Xpert) Error processing the view (A generic problem occurred while applying the view '[view name]'. (Cascade Pilot) No packets captured! As no data was captured, closing the temporary capture file! (Wireshark) Workaround Try to execute packet operations as sequentially (one operation at a time) as possible. If you want to download packets using the Packet Download Manager and analyze packets in Cascade Pilot, for example, perform one operation and wait for all packets to download before you perform the next operation. If the appliance gets into a state where no actions are being performed and no new actions can be performed, reboot the appliance. ARX-1-6 AppResponse Xpert/Release 8.6 712-00199-01

Microflow Indexing is Enabled by Default AppResponse Xpert RPM Integration Version 2 Getting Started Guide The appliance creates Microflow Index data for all capture jobs as long as a Shark Module license is installed and RPM Integration v2 software is running. Note the following: Memory Allocation of Microflow Index Data Enable / Disable Microflow Indexing Memory Allocation of Microflow Index Data The total amount of disk storage available for Microflow Indexes is 50GB, on all ARX models. This storage space is spread equally across all active jobs. If MIfGs are disabled, the only active capture job is arx and all 50GB of storage is available for the arx capture job Microflow Index. If MIfGs are enabled with four active MIfG ports, each capture job has 12.5GB available for its index. If MIfGs are enabled, any reconfiguration (MIfG enabling, disabling, reconfiguring) automatically expands or reduces the amount of index space for each active job. Warning The following actions will delete all index data for the affected MIfG and the aggregating interface (arx): Enable data collection for Monitoring Interface Groups (deletes the index on the aggregate capture job arx) Disable data collection for Monitoring Interface Groups (deletes the index on the associated MIfG capture job) Enable a MIfG interface (reduces the size of the index available for each MIfG, so it might prune the index for a MIfG that was already running) Disable a MIfG interface (removes the index of the capture job associated with that MIfG and increases the available disk space for other MIfG indexes) Change the assignment of physical ports to a MIfG interface (deletes the index for the affected MIfGs) AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-7

Enable / Disable Microflow Indexing Microflow Indexing is enabled by default. Disabling this process is generally reserved for cases where indexing computation affects the performance of other processes on the appliance: Application Stream Analysis, High Speed Capture, Web Transaction Analysis, Database Performance Monitoring, and so on. You can enable and disable Microflow Indexing in the CLI. Log in to the appliance as Administrator using an SSH-enabled program such as putty. Then enter the command shark. The following commands are available: capture_job index enable Enables Microflow Indexing on all capture jobs. capture_job index disable Disables Microflow Indexing on all capture jobs. capture_job list Returns the current state of the capture jobs. Warning If you disable indexing, all index data on the appliance will be deleted. You Cannot Lock Trace Clips on AppResponse Xpert Appliances Locking trace clips on an AppResponse Xpert appliance is not supported. When you right-click on a trace clip and choose Lock, this menu item has no effect. This menu item will be grayed out in a future release. ARX-1-8 AppResponse Xpert/Release 8.6 712-00199-01

Licensing Requirements AppResponse Xpert RPM Integration Version 2 Getting Started Guide To enable RPM Integration, you need to download and install the RPMIntegration patch on the AppResponse Xpert appliance. This patch provides two features: Analysis of AppResponse Xpert packets using Shark Module and Cascade Pilot. This requires both Cascade Pilot and Shark Module licenses. For information about purchasing these licenses, contact your Riverbed sales representative. RPM Integration v2 requires Cascade Pilot 10.5 or later. Export of AppResponse Xpert flow records to Cascade Profiler. This capability is included in the RPMIntegration patch and does not require a Shark Module license. RPM Integration v2 requires Cascade Profiler 10.0.7 or later. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-9

System Requirements RPM Integration has the following system requirements: Required Hardware and Software Required Software on your Local Computer Required Cascade Profiler Version for Flow Export Required Hardware and Software RPM Integration version 2 release requires the following: One or more 2200, 3300, 3700, 3800, 4200, 4300, 5000, 5100 or 6000 appliances. RPM Integration is not supported on any other appliance model. The RPM Integration host appliance must have release 8.6.8 installed. If you have a supported hardware model with an earlier release, you must update the appliance before you can install the RPM Integration software. Note You might need to update the appliance in several phases, as described in step 2) of RPM Integration Setup on page ARX-1-12 Required Software on your Local Computer You must have the following software installed on your local host: Cascade Pilot release 10.5 or later (Optional) For advanced transaction analysis from Cascade Pilot to AppTransaction Xpert, you need AppTransaction Xpert 16.5.T PL1 or higher. All these products are available for download at Riverbed Support (https://support.riverbed.com). Required Cascade Profiler Version for Flow Export To receive flow records from AppResponse Xpert, a Cascade Profiler appliance must have release 10.0.7 or later installed. Verifying Your AppResponse Xpert Appliance To verify that RPM Integration is supported on your appliance, do the following: 1) Log in to the appliance web UI (https:appliance-name-or-ip:8443). 2) Verify the appliance model and installed software: a) Navigate to the System > Setup page. b) Check the appliance model in the top left of the table: ARX-1-10 AppResponse Xpert/Release 8.6 712-00199-01

Figure 1-1 Appliance Model in Web UI > System > Setup Page The appliance model must be one of the following: 2200, 3300, 3700, 3800, 4200, 4300, 5000, 5100 or 6000. RPM Integration is not supported on any other appliance model. c) Verify that the Installed Version is 8.6.8. If the appliance has an earlier release, you must update the appliance 8.6.8 before you install the RPMIntegration patch. For complete instructions, see the AppResponse Xpert 8.6.8 Software Install Guide. Note You can download software and documentation for AppResponse Xpert, Cascade Pilot, Cascade Profiler, and AppTransaction Xpert from Riverbed Support (https://support.riverbed.com). AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-11

RPM Integration Setup The following steps outline the end-to-end workflow for setting up RPM Integration: 1) Verify that your appliance meets all RPM Integration system requirements if you have not already done so. This workflow is described in Verifying Your AppResponse Xpert Appliance on page ARX-1-10. 2) Update the appliance to release 8.6.8 as described in the AppResponse Xpert 8.6.8 Software Install Guide. The exact workflow for updating to 8.6.8 depends on the software currently installed on the appliance. The workflow can require up to three separate procedures: a) Install the 8.6.2 software. If the appliance is currently running 8.5.5 or earlier, update the appliance to 8.6.2. b) Install the System-Level Upgrade. This Upgrade ensures that all processes on the appliance run in 64-bit mode. The Software Install Guide describes how to determine whether you need to install this Upgrade. Note The System-Level Upgrade can take from 1 hour to 2 days to complete. The appliance cannot collect data while the Upgrade is in process. Riverbed recommends that you install this Upgrade during a two-day time window when you do not need the appliance for mission-critical work. c) Install the 8.6.8 software. When the appliance has release 8.6.2 (or 8.6.6) with JAR class s210 installed, you can install the 8.6.8 release. To download the Software Install Guide, go to the Riverbed Support site (https://support.riverbed.com) and navigate to the page for AppResponse Xpert Appliance version 8.6.8. 3) Install the RPMIntegration patch on the appliance. If your local host can connect to the appliance and to the Riverbed Update Center server, do the following: a) Open the Update Center (Java console > Insights > Update Center). b) In the Update Center, click Manage Servers and add the following URL to your Update Server list: support.opnet.com/ace_live/insights/support/patches/rpmintegration ARX-1-12 AppResponse Xpert/Release 8.6 712-00199-01

c) In the Update Center treeview, navigate to the following section: support.opnet.com/ace_live/insights/support/patches/rpmintegration d) Select the checkbox for the RPMIntegration patch, as shown in the following example. (The release number in the patch name should match the software release currently installed on the appliance.) e) Click Download and wait for the download to complete. Note The RPMIntegration patch is fairly large and the download might take ten minutes or more, depending on the available bandwidth. f) Click Install. If the appliance is in a secure environment (no internet access) do the following: a) Open a web browser, go to Riverbed Support (https://support.riverbed.com), and navigate to the downloads page for AppResponse Xpert 8.6.2. b) Follow the RPM Integration link (under Related Software) and download the ZIP file for the RPMIntegration patch. c) Extract the contents of the ZIP file to a recordable medium such as a USB drive or recordable CD-ROM. d) Bring the recordable medium into the secure environment and copy the ZIP file to the computer you use to connect to the appliance. e) Extract the contents of the ZIP file to a temporary directory. f) Log in to the secure appliance and open a Java console window. g) Choose Tools > Preferences. In the Insights tab, specify the temporary directory with the RPMIntegration files. h) Choose Insights > Update Center. i) In the Update Center dialog box, click Edit Servers. j) In the Edit Servers dialog box, select the Visible checkbox for Local Insight Directory and click OK. k) Select the Local Insight Directory and the RPMIntegration patch. Then click Install. The patch is installed on the secure appliance. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-13

4) Add the Shark Module license on the appliance. Note You should have received a license key from Riverbed after you purchased your Shark Module license. If you did not receive this key, contact your Riverbed sales representative. a) On the Tools menu, choose License Manager. b) In the License Manager window, enter the license key and click Submit. 5) Install Cascade Pilot 10.5 on your local computer. 6) (Optional) Install AppTransaction Xpert 16.5.T PL1 on your local computer. This required only if you have an AppTransaction Xpert license and want to perform advanced transaction analysis from Pilot to AppTransaction Xpert, Note You can download software and documentation for your AppResponse Xpert appliance (including the stand-alone console), Cascade Pilot, Cascade Profiler, and AppTransaction Xpert from Riverbed Support (https://support.riverbed.com). ARX-1-14 AppResponse Xpert/Release 8.6 712-00199-01

Cascade Pilot: Viewing AppResponse Xpert Data AppResponse Xpert RPM Integration Version 2 Getting Started Guide After you download, install, and run the Cascade Pilot application, you need to create a connection to the AppResponse Xpert appliance. This section discusses the following: Connecting Cascade Pilot to an AppResponse Xpert Appliance Analyzing AppResponse Xpert Packets in Cascade Pilot (Retrospective Analysis) on page ARX-1-17 Connecting Cascade Pilot to an AppResponse Xpert Appliance Procedure 1-1 To connect Cascade Pilot to Shark Module on an AppResponse Xpert appliance: 1 Open the Cascade Pilot application. 2 Click on the Probes tab and choose Add Probe. The Connect to Probe dialog box appears. Figure 1-2 Connect to Probe Dialog Box Enter appliance IP or name Port # Description Username Password 3 In the Connect to Probe dialog box, enter the IP address, HTTPS port (in the Auto field, top right), username/password, and proxy information for the Cascade appliance. Note By default, an AppResponse Xpert appliance listens on port 8443 for HTTPS data requests. You only need to set this field if the appliance uses a non-default port to receive HTTPS data requests. Note You might see a Certificate Verification Warning and a prompt to accept the certificate. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-15

4 When Cascade Pilot verifies that it is able to connect to the appliance, a Probe running message appears at the bottom of the dialog box. When this message appears, click OK. Figure 1-3 Probe Running Indicator (Cascade Pilot) 5 A new Shark Module probe appears in the Devices treeview (top left). Figure 1-4 ARX Probe in Devices Treeview (Cascade Pilot) To apply a view to an interface, drag it from the Views pane Note the following: The Devices treeview shows multiple arx live interfaces under the ARX probe: ARX-1-16 AppResponse Xpert/Release 8.6 712-00199-01

An aggregate interface (arx (Monitoring Interfaces Aggregate)), which includes data for all packets on all connected interfaces One or more individual interfaces: mifg1_name (Monitoring Interface Group 1), mifg2_name (Monitoring Interface Group 2), etc. The interfaces that are active depend on whether the appliance has Monitoring Interface Groups defined (appliance web UI > System > Interface Groups > Collect data for Monitoring Interface Groups). If no Monitoring Interface Groups are defined, the Aggregate interface is active and the individual live interfaces are inactive. If one or more groups are defined, each corresponding Monitoring Interface Group job is active (if the MIfG port is connected to at least one physical port) and the aggregate job is inactive. End of Procedure 1-1 Analyzing AppResponse Xpert Packets in Cascade Pilot (Retrospective Analysis) After you set up RPM Integration on an appliance (as described in Procedure 1-1), you can view and analyze the packet data in Cascade Pilot. This section discusses the following: Important Notes about Retrospective Analysis Selecting Packets in Cascade Pilot for Retrospective Analysis Selecting Packets in AppResponse Xpert for Retrospective Analysis in Cascade Pilot Important Notes about Retrospective Analysis Note the following: This workflow requires that packet storage be enabled on the appliance during the time window of interest. Otherwise the Java console shows a message saying that the agent does not have the requested preview data. Packet storage is configured in the appliance web UI > System > Capture page. Cascade Pilot supports export of packet data to AppTransaction Xpert (release 16.5.T PL1 and higher). If you have a license for AppTransaction Xpert, you can send packet data from Cascade Pilot directly to AppTransaction Xpert. You can quickly open large packet files for offline, multi-tier transaction analysis and performance prediction. This supports a streamlined troubleshooting workflow across three products (AppResponse Xpert > Cascade Pilot > AppTransaction Xpert). AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-17

For more information, see the Cascade Pilot Reference Manual > Overview > Cascade Pilot - Feature Summary > AppTransaction Xpert Integration. Selecting Packets in Cascade Pilot for Retrospective Analysis After you set up a probe to the Shark Module on the AppResponse Xpert appliance, you can analyze packets using the same tools and workflows as you would when analyzing packets on a Shark appliance. All the standard Cascade Pilot functionality is supported: Trace Clips, Views, Filters, Drill Downs, and so on. Note This workflow requires v2 (or higher) of RPM Integration. You can download software and documentation for Cascade Pilot from Riverbed Support (https://support.riverbed.com). Selecting Packets in AppResponse Xpert for Retrospective Analysis in Cascade Pilot This workflow involves the following general steps: 1) Select the packets you want to analyze in an AppResponse Xpert alert, insight, table, and chart. 2) Save the packets to a trace clip or PCAP file on the appliance, or a trace file on your local host. 3) Analyze the trace clip, PCAP file, or trace file in Cascade Pilot. This workflow is supported in all versions of RPM Integration. Procedure 1-2 Selecting packets in AppResponse Xpert for retrospective analysis in Cascade Pilot: 1 Open a Java console and connect to the AppResponse Xpert appliance. 2 Java console: Drill down to the traffic you want to analyze in Cascade Pilot. You can analyze traffic from an insight, a table, or a chart. Note It is good practice to drill down to the traffic of interest, and to exclude as much irrelevant traffic as possible, from your Cascade Pilot analysis. The more traffic you try to analyze, the longer it takes for the Shark Module and Cascade Pilot to process and display the data. It is especially important to Define as short a time window as possible. Include only IP conversations of interest in the traffic selection. ARX-1-18 AppResponse Xpert/Release 8.6 712-00199-01

Figure 1-5 Drilling Down to Traffic for Analysis in Cascade Pilot AppResponse Xpert RPM Integration Version 2 Getting Started Guide 1) Drill down to time window of interest by setting the Project Time or dragging horizontally in a time series chart 2) Drill down to the IP conversation(s) you want to analyze 3) Right-click and choose Analyze In > Cascade Pilot 3 Right-click on the traffic of interest and choose Analyze In > Cascade Pilot. The Cascade Pilot Preview window appears. 4 Cascade Pilot Preview window: Edit the preview data further if desired. The goal is to include all traffic of interest to your Cascade Pilot analysis, while at the same time excluding as much irrelevant traffic as possible. You can Select individual tiers or tier pairs (Tier Pair Circle/Tier Table, Tier Table) Zoom in on a time window (drag horizontally in time graph) Edit the time window and IPs displayed (click Edit Preview) AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-19

Figure 1-6 Cascade Pilot Preview 5 When you finish editing the preview, click Analyze Selected. The Shark Module creates a new trace clip for the selected packets. The trace clip appears below the capture job in the Cascade Pilot Files pane (Figure 1-7 on page ARX-1-21). (If RPM Integration v1 is installed, the Shark Module creates a PCAP file rather than a trace clip, as described in Note: Retrospective Analysis in RPM Integration v2 vs. v1 on page ARX-1-22.) You can now use the full range of visualization, analysis, and reporting functionality in Cascade Pilot on your AppResponse Xpert trace clip. ARX-1-20 AppResponse Xpert/Release 8.6 712-00199-01

Figure 1-7 AppResponse Xpert Packet-Capture Files in Cascade Pilot To copy packets to a file, drag the trace clip to Local System or My Files To apply a view to a file, drag it from Views onto the file Use right-click menu for trace clip to Create view Send to WireShark AppTransact ion Xpert Export to PCAP or other trace file format Cut, copy, paste, delete, rename trace clip End of Procedure 1-2 AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-21

Note: Retrospective Analysis in RPM Integration v2 vs. v1 The Selecting Packets in Cascade Pilot for Retrospective Analysis workflow has changed from the v1 to the v2 releases of RPM Integration. When you click Analyze Selected for a set of packets in the Java console > Cascade Pilot Preview window, the Shark module does the following: RPMI v2: Creates a Trace Clip of the selected packets. The Trace Clip appears below the capture job in the Cascade Pilot Files pane. RPMI v1: Creates a new PCAP file on the appliance and copies all selected packets from the High Speed Capture buffer to the PCAP file. This file appears under the My Files subtree. ARX-1-22 AppResponse Xpert/Release 8.6 712-00199-01

Cascade Profiler: AppResponse Xpert Flow Export to Profiler RPM Integration includes a shark CLI program for configuring the appliance to export flow data to Cascade Profiler. The following sections describe how to use this program. Configuring Profiler Export: Workflow Description Shark Command Reference Configuring Profiler Export: Workflow Description The following procedure describes the standard workflow for configuring Profiler export on an appliance. Procedure 1-3 To configure Profiler on an AppResponse Xpert appliance: 1 It is good practice to synchronize the Cascade Profiler and the AppResponse Xpert appliances to an accurate NTP time server. To synchronize the appliances, do the following: Specify an external NTP server for Cascade Profiler: 1.1 Log in to the Cascade Profiler web UI. 1.2 Navigate to the Configuration > General Settings page and check the Synchronize to an external NTP server option (under Time Configuration). 1.3 If this option is not selected, select it and specify an NTP server IP. 1.4 Click Configure Now (at the bottom of the page) and wait for the appliance to reboot. Specify an external NTP server for AppResponse Xpert 1.5 Log in to the AppResponse Xpert web UI. 1.6 Navigate to the System > Setup page and check the NTP Servers field. 1.7 If this field does not include the same NTP server as the Cascade Profiler appliance, add the NTP Server IP. 1.8 Click Apply (at the bottom of the page) and wait for the appliances to reboot. 2 Log in the appliance as a user with Administrator privileges, using an SSH-enabled program such as putty. 3 Enter the following command at the CLI prompt: shark 4 Run the following command: system status 5 If the system status is not running, enter the following command: system start AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-23

6 (Optional) Set up security certificates on the AppResponse Xpert appliance and the Profiler. Note Cascade Profiler is pre-installed with a set of default certificates. You need to do this step only if you do not want to use the default certificates. The CLI provides the following operations for setting up certificates: certificate profiler_export generate certificate profiler_export list certificate profiler_export update certificate profiler_trusted add certificate profiler_trusted delete certificate profiler_trusted list For detailed descriptions of these commands, see Shark Command Reference on page ARX-1-26. 6.1 Generate a new certificate on the appliance. In the shark CLI, enter the following command: certificate profiler_export generate 6.2 Enter the certificate information requested in the CLI: email, organization, unit, and so on. 6.3 Enter the following command at the CLI: certificate profiler_export list 6.4 Go to the Profiler web UI > Configuration > Appliance Security > Encryption Key Management page. 6.5 In the Trusted Certificates tabbed page, click New Certificate. 6.6 Copy the certificate string (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----delineators) from the shark CLI to the Add New Certificate page, enter a description for the certificate, and click OK. 6.7 In the Local Credentials tabbed page, navigate to the certificate you want to install on the appliance. In the pull-down appliance, click Download Certificate and save the PEM file on your local host. 6.8 In the shark CLI, enter the following command: certificate profiler_trusted add 6.9 When prompted, enter the certificate ID and the PEM. 7 Specify the target Profiler(s) for the AppResponse Xpert data: 7.1 At the shark CLI, enter the following command: profiler_export profilers configure 7.2 This command prompts you for two Profilers. You can enter an IP or a DNS name. If you are specifying one Profiler only, press the Space key at the second prompt. 8 Configure the adapter ports used to export the Profiler data. 8.1 Enter the following command: ARX-1-24 AppResponse Xpert/Release 8.6 712-00199-01

profiler_export ports configure 8.2 For each interface under the ARX probe, the CLI prompts you to specify the following options. To accept the default setting, press Enter: Enable/disable flow export Enable/disable VoIP data Specify BPF filter 9 Verify the connection between the AppResponse Xpert appliance and the Profiler: 9.1 Wait 20 minutes and then log in to the Profiler web UI. 9.2 Navigate to the System > Devices/Interfaces page and examine the Devices & Interfaces treeview. If the AppResponse Xpert appliance and interfaces you specified appear in the treeview, the configuration was successful and the Cascade Profiler appliance is able to receive traffic flow records from AppResponse Xpert. Note This release of RPM Integration has a known issue in which AppResponse Xpert devices and interfaces appear with yellow lights (Device clock is out of sync) even if their status is OK. This issue will be fixed in a future release of RPM Integration. Figure 1-8 Cascade Profiler Web UI > System > Devices/Interfaces Page End of Procedure 1-3 AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-25

Shark Command Reference The following table describes the CLI commands to configure Pilot capture jobs and to export data to Cascade Profiler. Enter shark at a CLI prompt to run these commands. Table 1-1 Command Shark CLI Command Reference Description capture_job index enable capture_job index disable capture job list certificate profiler_export generate certificate profiler_export list certificate profiler_export update certificate profiler_trusted add certificate profiler_trusted delete certificate profiler_trusted list exit help history log view <num-lines> profiler_export ports configure profiler_export ports list Enables Microflow Indexing on all capture jobs. Disables Microflow Indexing on all capture jobs Returns the current state of the Shark Module capture jobs. Generate a new self-signed certificate and private key for export to Profiler. The certificate can then be viewed using the command certificate profiler_export list and copied/pasted to the Profiler web UI. List local certificates for Profiler export. You can copy/paste a certificate from this list to trusted certificates of Cascade Profiler (Profiler web UI > Configuration > Appliance Security > Encryption Key Management). Update a new certificate on the AppResponse Xpert appliance. You must then enter the certificate PEM, which must contain both public and private keys. A PEM with multiple lines is acceptable. Upload a trusted Profiler certificate to the AppResponse Xpert appliance (create a new certificate if needed). You will be prompted for a certificate ID and the certificate PEM. The certificate ID is any string chosen by the user to name the certificate. You can copy/paste the PEM from the Profiler web UI > Configuration > Appliance Security > Encryption Key Management. A PEM with multiple lines is acceptable. Delete a trusted Profiler certificate. To obtain a list of acceptable certificate IDs, enter certificate profiler_trusted list. List certificates of trusted Profilers that have been configured on the AppResponse Xpert appliance. Exit from the Shark CLI console. Typing Ctrl+C has the same effect. Display help for the top commands. For help on a specific command, enter the following: help <command> Display a list of commands that have been executed in the current Shark CLI session. View the Shark server log to troubleshoot potential export problems with export to Profilers. The default number of lines to show is 100. Configure adapter port parameters: enable/disable Profiler Export, specify BPF filter, etc. To accept the default, press Enter. List the adapter ports and their configuration. ARX-1-26 AppResponse Xpert/Release 8.6 712-00199-01

Table 1-1 Command Shark CLI Command Reference Description profiler_export profilers configure profiler_export profilers list system start system status system stop system wipe Configure up to two Profilers to receive flow records from the local RPM Integration process. Enter the Profiler IP address/hostname for a new Profiler, press Enter accept the default Profiler, or press Space to remove the default Profiler. List profilers configured to receive flows from local Shark. Start the Shark process. This must be done to enable export to Profiler. Show Shark status: started or stopped, running or not, licensed or not. A Shark in started and not-running state indicates a problem. Stop the Shark process. This must be done to save resources when Shark is not licensed and no export to Profiler has been configured. Stop the Shark process and wipe all Shark data from the disk: views, logs, configurations, and certificates. Run this command to clean up disk space. AppResponse Xpert/Release 8.6 712-00199-01 ARX-1-27

What s New in 8.6 RPM Integration Getting Started Guide Release Date RPM Integration Version Description of Change July 23, 2013 8.6.2 First Issue July 24, 2013 8.6.2 Added note: Use an Accurate NTP Server for both Profiler and AppResponse Xpert Appliances Added step 1 to Procedure 1-3 describing how to synchronize appliances to an external server Added step 9 describing how to verify the connection between the Cascade Profiler and AppResponse Xpertappliances October 1, 2013 8.6.8 Updated System Requirements and System Requirements to include information about new appliance models introduced with the 8.6.8 software release: ARX-3300, ARX-3800, ARX-4300, or ARX-5100 January 6, 2014 v2 System Requirements Supported appliances RPM Integration v2 is now supported on 2200 appliances Required AppResponse Xpert software Release 8.6.8 (or higher) is required for RPM Integration v2 Required Cascade Pilot and software Release 10.5 (or higher) is required for RPM Integration v2 Verifying Your AppResponse Xpert Appliance To verify the appliance for v2, you need to check the appliance model and software release. Important Notes Removed note Do Not Run RPM Integration and Database Performance Monitoring at the Same Time New note If "Analyze In > Cascade Pilot" Right-Click Menu Item Does Not Appear, Specify Binary Path or Re-Install Cascade Pilot as Administrator on page ARX-1-3 New note To View Packets Captured Before RPM Integration v2 was Installed, Save the Packets to a Trace or PCAP File on page ARX-1-5 New note Avoid Multiple Simultaneous Packet Operations on the Appliance on page ARX-1-6 New note Microflow Indexing is Enabled by Default on page ARX-1-7 New note You Cannot Lock Trace Clips on AppResponse Xpert Appliances on page ARX-1-8 Analyzing AppResponse Xpert Packets in Cascade Pilot (Retrospective Analysis) Updated to include new v2 workflow, in which the appliance creates Trace Clips (rather than PCAP files) from selected packets. Shark Command Reference Updated to include Cascade Pilot capture_job commands ARX-1-28 AppResponse Xpert/Release 8.6 712-00199-01