Sensor Management

Manage capture sensors by using the Sensors ▶ Capture ▶ Sensors page.

Capture sensors are remote probes that listen and analyze network traffic to produce statistics that the datastore fetches and inserts into the central database.

Main View

The main view of the Sensors tab displays all current capture sensors. You can view the status of each capture sensor (for example, online, offline, or unregistered, and whether VPN is enabled), and see its assigned profile.

Tip: Click a column header to sort data according to that parameter. Use the search bar to filter capture sensors by Sensor hostname.

Click Actions to access these options for the selected capture sensors:

• Start capture
• Restart
• Stop capture
• Shutdown
• Deregister
• Enable VPN
• Disable VPN

Sidebar

Clicking a sensor hostname opens a sidebar where you can view the capture sensor's name and status with duration. From this sidebar, you can access summarized information and configure parameters.

Summary

The Summary tab displays capture sensor information such as IP address, profile, profile revision number, and software version.

From this tab, you can queue the capture sensor for a software update.

Click the ellipsis ... next to the name to perform an action for the specific capture sensor while it is online or synchronizing.

Configuration

The Configuration tab provides options for configuring sensor parameters. Use the search bar or the Expand all/Collapse all dropdown menu for easier navigation.

Tip: For some parameters, you can hover on a field to see a tooltip.

General settings

The parameter General settings ▶ Profile shows the same list as the Profiles tab.

By default, parameters are not automatically set. Selecting a profile sets some parameters according to the profile settings, but some parameters are sensor-specific. You can override the default value that comes with the profile, and you can click the button to revert to the profile value.

Toggle VM Agent on if you want to enable the reporting of capture sensor health monitoring metrics.

Auto-detected applications

This section lets you select the categories for which applications will be automatically detected.

Click Manage to open the Category settings modal and then enable automatic application detection for categories by using the corresponding toggle.

Click ✔ to save your changes.

eth settings

You can set the IPv4 netmask parameter by selecting a value from 8 to 32. Each value corresponds to a subnet mask as shown here:

Packet broker

This feature allows you to capture data remotely from a third-party tool.

Add and define packet brokers (remotes that are deployed at various locations) by going to Packet broker, clicking +, and then configuring the parameters.

In BPF, you can enter an optional BPF (Berkeley Packet Filter) rule string for the packets coming in for the packet broker. For example, ip host 10.0.0.1 and not (port 22 or port 80)