Skip to content
  • There are no suggestions because the search field is empty.

How to disable IPv6 at the kernel level on RSA Security Analytics appliances

Issue

How to disable IPv6 at the kernel level on RSA Security Analytics appliances.


Resolution

RSA Security Analytics parses the Concentrator logs and sometimes the client.ip is displayed with preceding "::fff:" which makes it not possible to parse the IPv4 IP. User tries to disable IPv6 under the interfaces but no differences are apparent. The log looks like the following:

           User admin (session 632, [::ffff:192.168.123.249]:56617) has requested the SDK language: id1=0 id2=0 time1=0 time2=0 options flags=1 size=10000

To disable IPv6, follow the steps below:

  1. Edit file /etc/sysctl.conf
    vi /etc/sysctl.conf
  2. Add the following lines:
    net.ipv6.conf.all.disable_ipv6 = 1
    net.ipv6.conf.default.disable_ipv6 = 1
          User-added
     
  3. Save and exit the file.
  4. Execute the following command to reflect the changes.
    sysctl -p
     
       To re-enable IPv6, remove the above lines from /etc/sysctl.conf and reboot the machine.

     

Note: If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Internal Comments

UserName:melim
8/5/2014 5:43:09 PM - review
sent an email to Ruby and gave some feedback on the KB: From: Meli, Marco Sent: 05 August 2014 18:42 To: Mathai, Ruby Subject: KB a67152 - review Hi Ruby, I am reviewing your KB article a67152. I have modified a bit the fonts. Please, see the attached instructions for next time. Can you please add to the case as a symptom, under what circumstance a customer would require to disable the IPv6 at kernel level? This would help to improve the article as it gives a scope. Let me know if you have any questions. Regards, Marco Meli | Technical Support Engineer

UserName:shurtj
8/12/2014 2:37:36 PM - Updated Article
Updated article and made changes to abide by Primus best practices.

UserName:almirm
8/28/2019 11:54 AM - Updated Article
Updated product version and added detailed steps on editing the configuration file.

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: All hosts
RSA Version/Condition: 10.x

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue