CLI command reference from OT network sensors
This article lists the CLI commands available from Defender for IoT OT network sensors.
Caution
Only documented configuration parameters on the OT network sensor and on-premises management console are supported for customer configuration. Do not change any undocumented configuration parameters or system properties, as changes may cause unexpected behavior and system failures.
Removing packages from your sensor without Microsoft approval can cause unexpected results. All packages installed on the sensor are required for correct sensor functionality.
Prerequisites
Before you can run any of the following CLI commands, you'll need access to the CLI on your OT network sensor as a privileged user.
While this article lists the command syntax for each user, we recommend using the admin user for all CLI commands where the admin user is supported.
For more information, see Access the CLI and Privileged user access for OT monitoring.
Appliance maintenance
Check OT monitoring services health
Use the following commands to verify that the Defender for IoT application on the OT sensor is working correctly, including the web console and traffic analysis processes.
Health checks are also available from the OT sensor console. For more information, see Troubleshoot the sensor.
User | Command | Full command syntax |
---|---|---|
admin | system sanity |
No attributes |
cyberx, or admin with root access | cyberx-xsense-sanity |
No attributes |
The following example shows the command syntax and response for the admin user:
shell> system sanity
[+] C-Cabra Engine | Running for 17:26:30.191945
[+] Cache Layer | Running for 17:26:32.352745
[+] Core API | Running for 17:26:28
[+] Health Monitor | Running for 17:26:28
[+] Horizon Agent 1 | Running for 17:26:27
[+] Horizon Parser | Running for 17:26:30.183145
[+] Network Processor | Running for 17:26:27
[+] Persistence Layer | Running for 17:26:33.577045
[+] Profiling Service | Running for 17:26:34.105745
[+] Traffic Monitor | Running for 17:26:30.345145
[+] Upload Manager Service | Running for 17:26:31.514645
[+] Watch Dog | Running for 17:26:30
[+] Web Apps | Running for 17:26:30
System is UP! (medium)
Restart an appliance
Use the following commands to restart the OT sensor appliance.
User | Command | Full command syntax |
---|---|---|
admin | system reboot |
No attributes |
cyberx_host , or admin with root access | sudo reboot |
No attributes |
For example, for the admin user:
shell> system reboot
Shut down an appliance
Use the following commands to shut down the OT sensor appliance.
User | Command | Full command syntax |
---|---|---|
admin | system shutdown |
No attributes |
cyberx_host, or admin with root access | sudo shutdown -r now |
No attributes |
For example, for the admin user:
shell> system shutdown
Show installed software version
Use the following commands to list the Defender for IoT software version installed on your OT sensor.
User | Command | Full command syntax |
---|---|---|
admin | system version |
No attributes |
cyberx , or admin with root access | cyberx-xsense-version |
No attributes |
For example, for the admin user:
shell> system version
Version: 22.2.5.9-r-2121448
Show current system date/time
Use the following commands to show the current system date and time on your OT network sensor, in GMT format.
User | Command | Full command syntax |
---|---|---|
admin | date |
No attributes |
cyberx , or admin with root access | date |
No attributes |
cyberx_host , or admin with root access | date |
No attributes |
For example, for the admin user:
shell> date
Thu Sep 29 18:38:23 UTC 2022
shell>
Turn on NTP time sync
Use the following commands to turn on synchronization for the appliance time with an NTP server.
To use these commands, make sure that:
- The NTP server can be reached from the appliance management port
- You use the same NTP server to synchronize all sensor appliances and the on-premises management console
User | Command | Full command syntax |
---|---|---|
admin | ntp enable <IP address> |
No attributes |
cyberx , or admin with root access | cyberx-xsense-ntp-enable <IP address> |
No attributes |
In these commands, <IP address>
is the IP address of a valid IPv4 NTP server using port 123.
For example, for the admin user:
shell> ntp enable 129.6.15.28
shell>
Turn off NTP time sync
Use the following commands to turn off the synchronization for the appliance time with an NTP server.
User | Command | Full command syntax |
---|---|---|
admin | ntp disable <IP address> |
No attributes |
cyberx , or admin with root access | cyberx-xsense-ntp-disable <IP address> |
No attributes |
In these commands, <IP address>
is the IP address of a valid IPv4 NTP server using port 123.
For example, for the admin user:
shell> ntp disable 129.6.15.28
shell>
Backup and restore
The following sections describe the CLI commands supported for backing up and restoring a system snapshot of your OT network sensor.
Backup files include a full snapshot of the sensor state, including configuration settings, baseline values, inventory data, and logs.
Caution
Do not interrupt a system backup or restore operation as this may cause the system to become unusable.
Start an immediate, unscheduled backup
Use the following command to start an immediate, unscheduled backup of the data on your OT sensor. For more information, see Set up backup and restore files.
Caution
Make sure not to stop or power off the appliance while backing up data.
User | Command | Full command syntax |
---|---|---|
admin | system backup create |
No attributes |
cyberx , or admin with root access | cyberx-xsense-system-backup |
No attributes |
For example, for the admin user:
shell> system backup create
Backing up DATA_KEY
...
...
Finished backup. Backup is stored at /var/cyberx/backups/e2e-xsense-1664469968212-backup-version-22.2.6.318-r-71e6295-2022-09-29_18:29:55.tar
Setting backup status 'SUCCESS' in redis
shell>
List current backup files
Use the following commands to list the backup files currently stored on your OT network sensor.
User | Command | Full command syntax |
---|---|---|
admin | system backup list |
No attributes |
cyberx , or admin with root access | cyberx-xsense-system-backup-list |
No attributes |
For example, for the admin user:
shell> system backup list
backup files:
e2e-xsense-1664469968212-backup-version-22.3.0.318-r-71e6295-2022-09-29_18:30:20.tar
e2e-xsense-1664469968212-backup-version-22.3.0.318-r-71e6295-2022-09-29_18:29:55.tar
shell>
Restore data from the most recent backup
Use the following command to restore data on your OT network sensor using the most recent backup file. When prompted, confirm that you want to proceed.
Caution
Make sure not to stop or power off the appliance while restoring data.
User | Command | Full command syntax |
---|---|---|
admin | system restore |
No attributes |
cyberx, or admin with root access | cyberx-xsense-system-restore |
-f <filename> |
For example, for the admin user:
shell> system restore
Waiting for redis to start...
Redis is up
Use backup file as "/var/cyberx/backups/e2e-xsense-1664469968212-backup-version-22.2.6.318-r-71e6295-2022-09-29_18:30:20.tar" ? [Y/n]: y
WARNING - the following procedure will restore data. do not stop or power off the server machine while this procedure is running. Are you sure you wish to proceed? [Y/n]: y
...
...
watchdog started
starting components
shell>
Display backup disk space allocation
The following command lists the current backup disk space allocation, including the following details:
- Backup folder location
- Backup folder size
- Backup folder limitations
- Last backup operation time
- Free disk space available for backups
User | Command | Full command syntax |
---|---|---|
admin | cyberx-backup-memory-check |
No attributes |
For example, for the admin user:
shell> cyberx-backup-memory-check
2.1M /var/cyberx/backups
Backup limit is: 20Gb
shell>
Local user management
Change local user passwords
Use the following commands to change passwords for local users on your OT sensor. The new password must be at least 8 characters, contain lowercase and uppercase, alphabetic characters, numbers and symbols.
When you change the password for the admin the password is changed for both SSH and web access.
User | Command | Full command syntax |
---|---|---|
admin | system password |
<username> |
The following example shows the admin user's changing the password. The new password does not appear on the screen when you type it, make sure to write to make a note of it and ensure that it is correctly typed when asked to reenter the password.
shell>system password user1
Enter New Password for user1:
Reenter Password:
shell>
Network configuration
Change networking configuration or reassign network interface roles
Use the following command to rerun the OT monitoring software configuration wizard, which helps you define or reconfigure the following OT sensor settings:
- Enable/disable SPAN monitoring interfaces
- Configure network settings for the management interface (IP, subnet, default gateway, DNS)
- Assigning a backup directory
User | Command | Full command syntax |
---|---|---|
admin | network reconfigure |
No attributes |
cyberx | python3 -m cyberx.config.configure |
No attributes |
For example, with the admin user:
shell> network reconfigure
The configuration wizard starts automatically after you run this command. For more information, see Install OT monitoring software.
Validate and show network interface configuration
Use the following commands to validate and show the current network interface configuration on the OT sensor.
User | Command | Full command syntax |
---|---|---|
admin | network validate |
No attributes |
For example, for the admin user:
shell> network validate
Success! (Appliance configuration matches the network settings)
Current Network Settings:
interface: eth0
ip: 172.20.248.69
subnet: 255.255.192.0
default gateway: 10.1.0.1
dns: 168.63.129.16
monitor interfaces mapping: local_listener=adiot0
shell>
Check network connectivity from the OT sensor
Use the following command to send a ping message from the OT sensor.
User | Command | Full command syntax |
---|---|---|
admin | ping <IP address> |
No attributes |
cyberx , or admin with root access | ping <IP address> |
No attributes |
In these commands, <IP address>
is the IP address of a valid IPv4 network host accessible from the management port on your OT sensor.
Locate a physical port by blinking interface lights
Use the following command to locate a specific physical interface by causing the interface lights to blink.
User | Command | Full command syntax |
---|---|---|
admin | network blink <INT> |
No attributes |
In this command, <INT>
is a physical ethernet port on the appliance.
The following example shows the admin user blinking the eth0 interface:
shell> network blink eth0
Blinking interface for 20 seconds ...
List connected physical interfaces
Use the following command to list the connected physical interfaces on your OT sensor.
User | Command | Full command syntax |
---|---|---|
admin | network list |
No attributes |
cyberx, or admin with root access | ifconfig |
No attributes |
For example, for the admin user:
shell> network list
adiot0: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 4096
ether be:b1:01:1f:91:88 txqueuelen 1000 (Ethernet)
RX packets 2589575 bytes 740011013 (740.0 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1 bytes 90 (90.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.18.0.2 netmask 255.255.0.0 broadcast 172.18.255.255
ether 02:42:ac:12:00:02 txqueuelen 0 (Ethernet)
RX packets 22419372 bytes 5757035946 (5.7 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 23078301 bytes 2544599581 (2.5 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 1000 (Local Loopback)
RX packets 837196 bytes 259542408 (259.5 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 837196 bytes 259542408 (259.5 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
shell>
Traffic capture filters
To reduce alert fatigue and focus your network monitoring on high priority traffic, you may decide to filter the traffic that streams into Defender for IoT at the source. Capture filters allow you to block high-bandwidth traffic at the hardware layer, optimizing both appliance performance and resource usage.
Use include an/or exclude lists to create and configure capture filters on your OT network sensors, making sure that you don't block any of the traffic that you want to monitor.
The basic use case for capture filters uses the same filter for all Defender for IoT components. However, for advanced use cases, you may want to configure separate filters for each of the following Defender for IoT components:
horizon
: Captures deep packet inspection (DPI) datacollector
: Captures PCAP datatraffic-monitor
: Captures communication statistics
Note
Capture filters don't apply to Defender for IoT malware alerts, which are triggered on all detected network traffic.
The capture filter command has a character length limit that's based on the complexity of the capture filter definition and the available network interface card capabilities. If your requested filter commmand fails, try grouping subnets into larger scopes and using a shorter capture filter command.
Create a basic filter for all components
The method used to configure a basic capture filter differs, depending on the user performing the command:
- cyberx user: Run the specified command with specific attributes to configure your capture filter.
- admin user: Run the specified command, and then enter values as prompted by the CLI, editing your include and exclude lists in a nano editor.
Use the following commands to create a new capture filter:
User | Command | Full command syntax |
---|---|---|
admin | network capture-filter |
No attributes. |
cyberx, or admin with root access | cyberx-xsense-capture-filter |
cyberx-xsense-capture-filter [-h] [-i INCLUDE] [-x EXCLUDE] [-etp EXCLUDE_TCP_PORT] [-eup EXCLUDE_UDP_PORT] [-itp INCLUDE_TCP_PORT] [-iup INCLUDE_UDP_PORT] [-vlan INCLUDE_VLAN_IDS] -m MODE [-S] |
Supported attributes for the cyberx user are defined as follows:
Attribute | Description |
---|---|
-h , --help |
Shows the help message and exits. |
-i <INCLUDE> , --include <INCLUDE> |
The path to a file that contains the devices and subnet masks you want to include, where <INCLUDE> is the path to the file. For example, see Sample include or exclude file. |
-x EXCLUDE , --exclude EXCLUDE |
The path to a file that contains the devices and subnet masks you want to exclude, where <EXCLUDE> is the path to the file. For example, see Sample include or exclude file. |
- -etp <EXCLUDE_TCP_PORT> , --exclude-tcp-port <EXCLUDE_TCP_PORT> |
Excludes TCP traffic on any specified ports, where the <EXCLUDE_TCP_PORT> defines the port or ports you want to exclude. Delimitate multiple ports by commas, with no spaces. |
-eup <EXCLUDE_UDP_PORT> , --exclude-udp-port <EXCLUDE_UDP_PORT> |
Excludes UDP traffic on any specified ports, where the <EXCLUDE_UDP_PORT> defines the port or ports you want to exclude. Delimitate multiple ports by commas, with no spaces. |
-itp <INCLUDE_TCP_PORT> , --include-tcp-port <INCLUDE_TCP_PORT> |
Includes TCP traffic on any specified ports, where the <INCLUDE_TCP_PORT> defines the port or ports you want to include. Delimitate multiple ports by commas, with no spaces. |
-iup <INCLUDE_UDP_PORT> , --include-udp-port <INCLUDE_UDP_PORT> |
Includes UDP traffic on any specified ports, where the <INCLUDE_UDP_PORT> defines the port or ports you want to include. Delimitate multiple ports by commas, with no spaces. |
-vlan <INCLUDE_VLAN_IDS> , --include-vlan-ids <INCLUDE_VLAN_IDS> |
Includes VLAN traffic by specified VLAN IDs, <INCLUDE_VLAN_IDS> defines the VLAN ID or IDs you want to include. Delimitate multiple VLAN IDs by commas, with no spaces. |
-p <PROGRAM> , --program <PROGRAM> |
Defines the component for which you want to configure a capture filter. Use all for basic use cases, to create a single capture filter for all components. For advanced use cases, create separate capture filters for each component. For more information, see Create an advanced filter for specific components. |
-m <MODE> , --mode <MODE> |
Defines an include list mode, and is relevant only when an include list is used. Use one of the following values: - internal : Includes all communication between the specified source and destination - all-connected : Includes all communication between either of the specified endpoints and external endpoints. For example, for endpoints A and B, if you use the internal mode, included traffic will only include communications between endpoints A and B. However, if you use the all-connected mode, included traffic will include all communications between A or B and other, external endpoints. |
Sample include or exclude file
For example, an include or exclude .txt file might include the following entries:
192.168.50.10
172.20.248.1
Create a basic capture filter using the admin user
If you're creating a basic capture filter as the admin user, no attributes are passed in the original command. Instead, a series of prompts is displayed to help you create the capture filter interactively.
Reply to the prompts displayed as follows:
Would you like to supply devices and subnet masks you wish to include in the capture filter? [Y/N]:
Select
Y
to open a new include file, where you can add a device, channel, and/or subnet that you want to include in monitored traffic. Any other traffic, not listed in your include file, isn't ingested to Defender for IoT.The include file is opened in the Nano text editor. In the include file, define devices, channels, and subnets as follows:
Type Description Example Device Define a device by its IP address. 1.1.1.1
includes all traffic for this device.Channel Define a channel by the IP addresses of its source and destination devices, separated by a comma. 1.1.1.1,2.2.2.2
includes all of the traffic for this channel.Subnet Define a subnet by its network address. 1.1.1
includes all traffic for this subnet.List multiple arguments in separate rows.
Would you like to supply devices and subnet masks you wish to exclude from the capture filter? [Y/N]:
Select
Y
to open a new exclude file where you can add a device, channel, and/or subnet that you want to exclude from monitored traffic. Any other traffic, not listed in your exclude file, is ingested to Defender for IoT.The exclude file is opened in the Nano text editor. In the exclude file, define devices, channels, and subnets as follows:
Type Description Example Device Define a device by its IP address. 1.1.1.1
excludes all traffic for this device.Channel Define a channel by the IP addresses of its source and destination devices, separated by a comma. 1.1.1.1,2.2.2.2
excludes all of the traffic between these devices.Channel by port Define a channel by the IP addresses of its source and destination devices, and the traffic port. 1.1.1.1,2.2.2.2,443
excludes all of the traffic between these devices and using the specified port.Subnet Define a subnet by its network address. 1.1.1
excludes all traffic for this subnet.Subnet channel Define subnet channel network addresses for the source and destination subnets. 1.1.1,2.2.2
excludes all of the traffic between these subnets.List multiple arguments in separate rows.
Reply to the following prompts to define any TCP or UDP ports to include or exclude. Separate multiple ports by comma, and press ENTER to skip any specific prompt.
Enter tcp ports to include (delimited by comma or Enter to skip):
Enter udp ports to include (delimited by comma or Enter to skip):
Enter tcp ports to exclude (delimited by comma or Enter to skip):
Enter udp ports to exclude (delimited by comma or Enter to skip):
Enter VLAN ids to include (delimited by comma or Enter to skip):
For example, enter multiple ports as follows:
502,443
In which component do you wish to apply this capture filter?
Enter
all
for a basic capture filter. For advanced use cases, create capture filters for each Defender for IoT component separately.Type Y for "internal" otherwise N for "all-connected" (custom operation mode enabled) [Y/N]:
This prompt allows you to configure which traffic is in scope. Define whether you want to collect traffic where both endpoints are in scope, or only one of them is in the specified subnet. Supported values include:
internal
: Includes all communication between the specified source and destinationall-connected
: Includes all communication between either of the specified endpoints and external endpoints.
For example, for endpoints A and B, if you use the
internal
mode, included traffic will only include communications between endpoints A and B.
However, if you use theall-connected
mode, included traffic will include all communications between A or B and other, external endpoints.The default mode is
internal
. To use theall-connected
mode, selectY
at the prompt, and then enterall-connected
.
The following example shows a series of prompts that creates a capture filter to exclude subnet 192.168.x.x
and port 9000:
root@xsense: network capture-filter
Would you like to supply devices and subnet masks you wish to include in the capture filter? [y/N]: n
Would you like to supply devices and subnet masks you wish to exclude from the capture filter? [y/N]: y
You've exited the editor. Would you like to apply your modifications? [y/N]: y
Enter tcp ports to include (delimited by comma or Enter to skip):
Enter udp ports to include (delimited by comma or Enter to skip):
Enter tcp ports to exclude (delimited by comma or Enter to skip):9000
Enter udp ports to exclude (delimited by comma or Enter to skip):9000
Enter VLAN ids to include (delimited by comma or Enter to skip):
In which component do you wish to apply this capture filter?all
Would you like to supply a custom base capture filter for the collector component? [y/N]: n
Would you like to supply a custom base capture filter for the traffic_monitor component? [y/N]: n
Would you like to supply a custom base capture filter for the horizon component? [y/N]: n
type Y for "internal" otherwise N for "all-connected" (custom operation mode enabled) [Y/n]: internal
Please respond with 'yes' or 'no' (or 'y' or 'n').
type Y for "internal" otherwise N for "all-connected" (custom operation mode enabled) [Y/n]: y
starting "/usr/local/bin/cyberx-xsense-capture-filter --exclude /var/cyberx/media/capture-filter/exclude --exclude-tcp-port 9000 --exclude-udp-port 9000 --program all --mode internal --from-shell"
No include file given
Loaded 1 unique channels
(000) ret #262144
(000) ldh [12]
......
......
......
debug: set new filter for horizon '(((not (net 192.168))) and (not (tcp port 9000)) and (not (udp port 9000))) or (vlan and ((not (net 192.168))) and (not (tcp port 9000)) and (not (udp port 9000)))'
root@xsense:
Create an advanced filter for specific components
When configuring advanced capture filters for specific components, you can use your initial include and exclude files as a base, or template, capture filter. Then, configure extra filters for each component on top of the base as needed.
To create a capture filter for each component, make sure to repeat the entire process for each component.
Note
If you've created different capture filters for different components, the mode selection is used for all components. Defining the capture filter for one component as internal
and the capture filter for another component as all-connected
isn't supported.
User | Command | Full command syntax |
---|---|---|
admin | network capture-filter |
No attributes. |
cyberx, or admin with root access | cyberx-xsense-capture-filter |
cyberx-xsense-capture-filter [-h] [-i INCLUDE] [-x EXCLUDE] [-etp EXCLUDE_TCP_PORT] [-eup EXCLUDE_UDP_PORT] [-itp INCLUDE_TCP_PORT] [-iup INCLUDE_UDP_PORT] [-vlan INCLUDE_VLAN_IDS] -p PROGRAM [-o BASE_HORIZON] [-s BASE_TRAFFIC_MONITOR] [-c BASE_COLLECTOR] -m MODE [-S] |
The following extra attributes are used for the cyberx user to create capture filters for each component separately:
Attribute | Description |
---|---|
-p <PROGRAM> , --program <PROGRAM> |
Defines the component for which you want to configure a capture filter, where <PROGRAM> has the following supported values: - traffic-monitor - collector - horizon - all : Creates a single capture filter for all components. For more information, see Create a basic filter for all components. |
-o <BASE_HORIZON> , --base-horizon <BASE_HORIZON> |
Defines a base capture filter for the horizon component, where <BASE_HORIZON> is the filter you want to use. Default value = "" |
-s BASE_TRAFFIC_MONITOR , --base-traffic-monitor BASE_TRAFFIC_MONITOR |
Defines a base capture filter for the traffic-monitor component. Default value = "" |
-c BASE_COLLECTOR , --base-collector BASE_COLLECTOR |
Defines a base capture filter for the collector component. Default value = "" |
Other attribute values have the same descriptions as in the basic use case, described earlier.
Create an advanced capture filter using the admin user
If you're creating a capture filter for each component separately as the admin user, no attributes are passed in the original command. Instead, a series of prompts is displayed to help you create the capture filter interactively.
Most of the prompts are identical to basic use case. Reply to the following extra prompts as follows:
In which component do you wish to apply this capture filter?
Enter one of the following values, depending on the component you want to filter:
horizon
traffic-monitor
collector
You're prompted to configure a custom base capture filter for the selected component. This option uses the capture filter you configured in the previous steps as a base, or template, where you can add extra configurations on top of the base.
For example, if you'd selected to configure a capture filter for the
collector
component in the previous step, you're prompted:Would you like to supply a custom base capture filter for the collector component? [Y/N]:
Enter
Y
to customize the template for the specified component, orN
to use the capture filter you'd configured earlier as it is.
Continue with the remaining prompts as in the basic use case.
List current capture filters for specific components
Use the following commands to show details about the current capture filters configured for your sensor.
User | Command | Full command syntax |
---|---|---|
admin | Use the following commands to view the capture filters for each component: - horizon: edit-config horizon_parser/horizon.properties - traffic-monitor: edit-config traffic_monitor/traffic-monitor - collector: edit-config dumpark.properties |
No attributes |
cyberx, or admin with root access | Use the following commands to view the capture filters for each component: -horizon: nano /var/cyberx/properties/horizon_parser/horizon.properties - traffic-monitor: nano /var/cyberx/properties/traffic_monitor/traffic-monitor.properties - collector: nano /var/cyberx/properties/dumpark.properties |
No attributes |
These commands open the following files, which list the capture filters configured for each component:
Name | File | Property |
---|---|---|
horizon | /var/cyberx/properties/horizon.properties |
horizon.processor.filter |
traffic-monitor | /var/cyberx/properties/traffic-monitor.properties |
horizon.processor.filter |
collector | /var/cyberx/properties/dumpark.properties |
dumpark.network.filter |
For example with the admin user, with a capture filter defined for the collector component that excludes subnet 192.168.x.x and port 9000:
root@xsense: edit-config dumpark.properties
GNU nano 2.9.3 /tmp/tmpevt4igo7/tmpevt4igo7
dumpark.network.filter=(((not (net 192.168))) and (not (tcp port 9000)) and (not
dumpark.network.snaplen=4096
dumpark.packet.filter.data.transfer=false
dumpark.infinite=true
dumpark.output.session=false
dumpark.output.single=false
dumpark.output.raw=true
dumpark.output.rotate=true
dumpark.output.rotate.history=300
dumpark.output.size=20M
dumpark.output.time=30S
Reset all capture filters
Use the following command to reset your sensor to the default capture configuration with the cyberx user, removing all capture filters.
User | Command | Full command syntax |
---|---|---|
cyberx, or admin with root access | cyberx-xsense-capture-filter -p all -m all-connected |
No attributes |
If you want to modify the existing capture filters, run the earlier command again, with new attribute values.
To reset all capture filters using the admin user, run the earlier command again, and respond N
to all prompts to reset all capture filters.
The following example shows the command syntax and response for the cyberx user:
root@xsense:/# cyberx-xsense-capture-filter -p all -m all-connected
starting "/usr/local/bin/cyberx-xsense-capture-filter -p all -m all-connected"
No include file given
No exclude file given
(000) ret #262144
(000) ret #262144
debug: set new filter for dumpark ''
No include file given
No exclude file given
(000) ret #262144
(000) ret #262144
debug: set new filter for traffic-monitor ''
No include file given
No exclude file given
(000) ret #262144
(000) ret #262144
debug: set new filter for horizon ''
root@xsense:/#