NetWitness - How to install a 1GB INTEL PRO/1000 PF DUAL PORT NIC Card in a NetWitness Archiver

Issue

This article describes how to install the driver for a 1GB INTEL PRO/1000 PF DUAL PORT NIC Card in a NetWitness Archiver

Drivers for NETWITNESS, PCI-E, INTEL PRO/1000 PF DUAL PORT NIC Card are already installed on the appliance so there is no need to update CentOS kernel or download/install any additional driver for the card as for the 10GB Fiber Card Adapter described in KB article: 000012175

Resolution

These are the steps required for the installation of a NETWITNESS, PCI-E, INTEL PRO/1000 PF DUAL PORT NIC Card :

1. Once the new card has been placed in the appliance, check if the PCI card is installed and discovered on the PCI bus:

# lspci -v | grep -i eth

01:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5720 Gigabit Ethernet PCIe
01:00.1 Ethernet controller: Broadcom Corporation NetXtreme BCM5720 Gigabit Ethernet PCIe
02:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5720 Gigabit Ethernet PCIe
02:00.1 Ethernet controller: Broadcom Corporation NetXtreme BCM5720 Gigabit Ethernet PCIe
05:00.0 Ethernet controller: Intel Corporation 82571EB Gigabit Ethernet Controller (rev 06)
05:00.1 Ethernet controller: Intel Corporation 82571EB Gigabit Ethernet Controller (rev 06)

It is the 82571EB Gigabit as expected

2. Verify if the persistent-net-generator.rules created the new entries in the file:

# /etc/udev/rules.d70-persistent-net.rules

# PCI device 0x14e4:0x165f (tg3) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="c8:1f:66:d1:8c:6e", ATTR{type}=="1", KERNEL=="eth*", NAME="em1"
# PCI device 0x14e4:0x165f (tg3) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="c8:1f:66:d1:8c:6f", ATTR{type}=="1", KERNEL=="eth*", NAME="em2"
# PCI device 0x14e4:0x165f (tg3) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="c8:1f:66:d1:8c:70", ATTR{type}=="1", KERNEL=="eth*", NAME="em3"
# PCI device 0x14e4:0x165f (tg3) (custom name provided by external tool)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="c8:1f:66:d1:8c:71", ATTR{type}=="1", KERNEL=="eth*", NAME="em4"
# PCI device 0x8086:0x105f (e1000e)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="68:05:ca:1a:ac:42", ATTR{type}=="1", KERNEL=="eth*", NAME="eth4"
# PCI device 0x8086:0x105f (e1000e)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="68:05:ca:1a:ac:43", ATTR{type}=="1", KERNEL=="eth*", NAME="eth5"

The name assigned to the NIC Gigabit interfaces are eth4 (MAC 68:05:ca:1a:ac:42) and eth5 (MAC 68:05:ca:1a:ac:43)

3. Create the following interface files for eth4:

/etc/sysconfig/network-scripts/ifcfg-eth4:
DEVICE=eth4
HWADDR=68:05:ca:1a:ac:42
TYPE=Ethernet
ONBOOT=no
NM_CONTROLLED=yes
BOOTPROTO=dhcp

4. Create the following interface files for eth5:

/etc/sysconfig/network-scripts/ifcfg-eth5
DEVICE=eth5
HWADDR=68:05:ca:1a:ac:43
TYPE=Ethernet
ONBOOT=no
NM_CONTROLLED=yes
BOOTPROTO=dhcp

5. Restart network service so the changes can take effect:

# service network restart

Please note there are separate steps for the S5 and S4 hardware:

Refer to the below links for S4 appliance:
https://community.netwitness.com/t5/netwitness-platform-hardware/s4-rsa-netwitness-suite-appliances-setup-guide/ta-p/546835

S5 appliances:
https://community.netwitness.com/t5/netwitness-platform-hardware/s5-rsa-netwitness-suite-appliances-setup-guide/ta-p/533323

S6 appliances:
https://community.netwitness.com/t5/netwitness-platform-hardware/series-6-hardware-setup-guide/ta-p/572346

Product Details

NetWitness Product Set: NetWitness Logs & Network
NetWitness Product/Service Type: Netwitness S6 Appliance
NetWitness Version/Condition: 10.x, 11.x, 12.x
Platform: CentOS / AlmaLinux
O/S Version: 7 / 8.9

Approval Reviewer Queue

Technical approval queue