Configuring session-reconstruction parameters

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:

$ ssh npadmin@10.1.0.1

or

$ ssh npadmin@exampleFQDN

Enter privileged mode:

npadmin@ia> enable

Enter the npadmin password. The password can be 5 to 24 characters long.

[sudo] password for npadmin: <password>

Enter configuration mode:

npadmin@ia# configure system

Enter the pivotengine menu:

npadmin@hostname(config) # pivotengine

PivotEngine/Session Reconstruction Parameters

Thumbnail Generation: Disabled

Assymetric Flow Stitching: Disabled

VLAN Tracking: On

-------------------------------------------------------------------

A: Toggle the Asymmetric Stitching of flows

T: Toggle whether to generate thumbnail or not

V: Toggle VLAN Tracking for reconstruction

Q: Exit and Save

Select which option you would like to change:

Press A to toggle the status of asymmetric stitching of flows.

By default, "Asymmetric Stitching of flows" is disabled so that the Packet Capture appliance can see bi-directional traffic on each configured capture interface. If your deployment has one capture interface / PX that records the inbound traffic while another capture interface / PX records the outbound traffic, you need to enable this option.

Press T to toggle the status of thumbnail generation.

When enabled, the Artifacts tab shows thumbnails for extracted artifacts after a successful session.

Press V to toggle the status of VLAN Tracking for reconstruction.

When enabled, Suricata will look for the same VLAN ID tag in incoming and outgoing flows during session reconstruction. If incoming traffic has a VLAN ID tag and outgoing traffic doesn't have a VLAN ID tag or vice versa, Suricata will not consider it as a session.

Press Q to save the settings and exit the pivotengine menu.