Install the Virtual Probe

The procedure to install a Virtual Probe on your virtual machine is specific to the Operating System running on it. This section provides the installation steps for Linux and Windows virtual machines.

Prerequisite:

Trellix recommends you update all the operating system packages before installing vIPS Probe in Windows or Linux machines.

To install the Virtual Probe on your Linux machines as a root user, follow the steps below:

Move the downloaded Probe Installation Package vIPS_Probe_Linux.tar.gz into an appropriate folder.
To unzip the package, execute the command tar xzf vIPS_Probe_Linux.tar.gz
Navigate to the extracted folder and go to the agent directory.
Note
When you download the Probe, the ip.txt file within the downloaded folder automatically takes the IP address of the Manager. Open the file and ensure that it contains the private IP address of the Manager.
To install the package, run the command ./install.sh
The Virtual Probe is now installed on your Linux machine.
To verify the Probe installation, execute the command service trellix_vips_probe status
(Optional) To start the service after it is stopped, execute the command sudo service trellix_vips_probe start
(Optional) To restart the Probe, execute the command sudo service trellix_vips_probe restart
(Optional) To stop the service, execute the command sudo service trellix_vips_probe stop

To verify if the Probe is successfully installed, perform the following steps:

Click Analysis → Virtual Machines. This displays the Virtual Machines page.

Check the state of the Probe in the State column of vIPS Probe. If the Probe is successfully running, the status is green in color.

You can also run the stats_client.py script in sudo mode for checking the inspected traffic statistics on the virtual machines. The stats_client.py script is used to confirm and troubleshoot connectivity with the other components. The script displays details, such as Sensor details, inspection mode, and Controller status. Sample output for stats_client.py script is given below:

Packets read from queue[0]: 561825
Bytes read from queue[0]: 321796393
Time waiting for packets from queue(ns): 26871840090079
Timed out reading packet from queue: 4723
Packets accepted[0]: 561339
Packets rejected[0]: 486
Time spent in verdicting(ns)[0]: 9441122857
Packets send to node[0]: 561082
Bytes send to node[0]: 333875820
Pings sent to node[0]: 11115
Packets received from node[0]: 560596
Bytes received from node[0]: 333375590
Time spent waiting to read from sensor(ns): 26803282492008
Time receiving packets from node(ns)[0]: 1870116120
Ping responses received[0]: 11115
Failed open after sending to sensor: 743
Queue Number[0]: 1
Node Address[0]: 10.1.1.1
Probe Id: f37d39e7-3517-4934-a82a-e5a42b3992e5
Inspection Mode: ips
Failure Handling: fail_open
Control State: CONTROLLER_CONNECTED
IPv4 packets: 561815
IPv6 packets: 10
TCP packets: 556894
UDP packets: 4921
Netfilter Queue Statistics
==========================
Q[1]: total pkts = 561082 current queued = 0, q_drops = 0, msg_drops = 0

Note
The script requires Python for Windows version 2.x for it to work.

To install the Virtual Probe on your Windows Virtual Machines as an administrator, follow the steps below:

Move the downloaded Probe Installation Package vIPS_Probe_Windows.zip into an appropriate folder.
Navigate to the folder where your Probe Installation Package is installed and unzip it.
Note
When you download the Probe, the agent.config file within the download folder automatically takes the IP address of the Manager. Open the file and ensure that it contains the private IP address of the Manager.
At the command prompt, navigate to the location of your batch file and run it using the command install.bat azure.

The command window will hang for a few seconds and disappear. This indicates the completion of the installation process.

You must run stats_client.py script in sudo mode for checking the inspected traffic statistics on the virtual machines. Sample output for stats_client.py script is given below:

Trellix vIPS Probe Statistics
================
 Packets read from queue[0]: 84522
 Bytes read from queue[0]: 31580372
 Time waiting for packets from queue(ns): 6532663311061
 Timed out reading packet from queue: 1660
 Packets accepted[0]: 84522
 Time spent in verdicting(ns)[0]: 1034205135
 Failed open after sending to sensor: 84522
 Queue Number[0]: 1
 Probe Id: 3985126c-378c-44cc-a4d9-4b9bca3e4r5t
 Inspection Mode: ips
 Failure Handling: fail_open
 Control State: CONTROLLER_CONNECTED
 IPv4 packets: 84512
 IPv6 packets: 10
 TCP packets: 83011
 UDP packets: 1501
 Netfilter Queue Statistics
==========================
 Q[1]: total pkts = 80528 current queued = 0, q_drops = 0, msg_drops = 0