nLive Core from Vigiliti Systems, Inc.

Full documentation is available at the web site http://www.vigiliti.com/documentation
in PDF format.

Content

The accompanying .bin file is either the installation file or update file for nLive Core.

Naming conventions

Names of the files are like 'xx_nlive_yy_a.b.c.d.bin'

xx can be 'install' or 'update'. Files starting with 'install' are full product installation packages. Files starting with 'update' are product update packages. The part following 'install' or 'update' is always 'nlive'.

yy has the following values:

c : means console alone
sfe: means sensor alone
sfc: means console and sensor are packaged together sff: means console and sensor are packaged together,

        but belong to the Free Edition of nLive Core.
        Free Edition has certain limitations.

If you would like to install console and sensor on the same hardware, please install only 'sfc' or 'sff'. Do not install 'sfe' and 'c' together on the same hardware or malfunction will occur.

a.b.c.d is the version number

a is the major version number
b is the minor version number
c is the sub1 version
d is the sub2 version

System Requirements

Dedicated hardware is required to run nLive Core. Since the product can put the hardware to significant stress, it is recommended that you use a recent set of components in the hardware.

Pentium 4 or equivalent CPU, 3 GHz, 1 GB RAM (2 GB preferred)

200GB hard disk. Larger hard disk is preferred for storage of data for longer periods of time. The disk should be local and not a network share.

2 free Ethernet ports - one for management and one for packet-capture.

Linux operating system (Fedora Core is the recommended operating system, but similar systems such as Red Hat Enterprise may work) with kernel version 2.6 or later. Special instructions for OS installation provided below should be strictly adhered to.

IMPORTANT NOTE:
Please note that nLive Core will not run on Microsoft Windows operating system or Solaris System.

Hardware preparation

OS preparation

In order to ensure correct operation of nLive Core, user should install the following components of the Linux system:

X Window System (No need to start it. You can the OS at runlevel 3)
Open LDAP clients
Samba clients
GNU C compiler and libraries (we will not compile any C code, but these are required)
Time synchronization using ntpd service to a time server

The following components should not be installed: - Web server or application server
- Java, JDK etc
- Firewall such as IP tables
- SE Linux (Security enhanced Linux)
- Any other major software that may take up CPU and RAM

Ethernet interface preparation

The network settings on the machine where nLive Core Sensor is installed (either alone or together with Console as a single package) should be as follows.

The machine should be given static IP address on the primary Ethernet interface (usually eth0), which will be used for management. A secondary interface, eth1, should have no IP address and will be used for packet capture. In order to set it with no IP address, you may want to edit the file /etc/sysconfig/network-scripts/ifcfg-eth1 and erase the line for the IP address, then reboot the system or restart network interface.

Switch Preparation

User should study and understand how to mirror traffic to a switch port where packets can be captured by nLive Core. The port mirroring is done in a similar fashion as a protocol analysis tool such as tcpdump etc. User can refer to the switch vendor's documentation for this purpose or contact the switch vendor.

The mirror port should be connected to the packet capture interface (eth1).

Installation Instructions

The installation packages are self-extracting binaries on X86 based 32 bit Linux platforms.

Full installation

Full installation packages are run as follows:

In order to install, login as root into a shell, Copy the correct installation binary on to the disk drive. then issue a chmod command to make it executable, like

chmod 744 install_nlive_yy_a.b.c.d.bin

Then execute the binary using the command:

./install_nlive_yy_a.b.c.d.bin

It will show a license agreement on the screen. In order to proceed with the installation you should read it and agree to it.

The default installation location is /opt. We recommend that you do not change this. Installation will only create/alter files under /opt/nLiveCore and nowhere else with the exception of /etc/init.d/nlive file
and /etc/rc*.d folders.

IMPORTANT NOTE:
Installation should be on a local disk drive and not a network drive.

Update installation

Updates are run by first logging in as root into shell, and copying the binary on to the disk drive into the folder /opt/nLiveCore/App/install. Then issue a chmod command to make it executable, like:

cd /opt/nLiveCore/App/install
chmod 744 update_nlive_yy_a.b.c.d.bin

Then stop currently running nLive Core by giving the command:

/etc/init.d/nlive stop

Then wait for about 20 seconds. Subsequently, issue:

/opt/nLiveCore/App/Script/run/nlive_update.sh update_nlive_yy_a.b.c.d.bin

where update_nlive_yy_zz.bin is to be replaced by the name of the actual update package. Once updating is complete, restart the package by the command:

/etc/init.d/nlive start

Setting up the product from the user interface

Product is started by the shell command

/etc/init.d/nlive start

Its status can be checked by

/etc/init.d/nlive status

After starting the product, one needs to go to a web browser (recommended browser is Microsoft Internet Explorer ver 6 or later) and login to the system as

https://system_address:port/

where system_address is the IP address or name of the machine on which nLive Core is running and port is the port chosen for the secure HTTP connection at the time of installation. If you have chosen port 443 or left it at default value, then you can omit 'port' in the above URL and simply point the browser to

https://system_address/

After accepting the self-signed certificate, the user interface should now be available for further setup and use. The default username is 'admin' and password is 'admin'. Please change the password to something that is hard to guess.

You may refer to the full documentation at http://www.vigiliti.com/documentation

Uninstallation

In order to uninstall the product(s), one needs to stop it first by giving the shell command as root:

/etc/init.d/nlive stop

Then one needs to uninstall the product manually by erasing all files under /opt/nLiveCore. This will also erase any data in the databases as well. One also needs to manually erase the
/etc/init.d/nlive script and the links under /etc/rc*.d folders.

If you wish to back up the database, please archive the entire folder structure under /opt/nLiveCore/App/Data.

Vigiliti Systems, Inc.
3940 Freedom Cir #207
Santa Clara, CA 95054

(Note that support is NOT PROVIDED for the Free Edition of nLive Core)

EMail: support@vigiliti.com
Web: www.vigiliti.com
Documentation: http://www.vigiliti.com/documentation