IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Qflow 1299 question

    Posted Wed March 08, 2023 07:59 AM

    Hello, I did add new virtual Qflow into deployment and the non-management interface doesnt have the "PROMISC" info. So I am wondering what is the mechanism which will switch the Qflow interface to "PROMISC" mode? 



    ------------------------------
    tysa
    ------------------------------


  • 2.  RE: Qflow 1299 question

    Posted Thu March 09, 2023 04:34 AM

    'not sure if that was the question, but I recall from vFlow times the promiscuous mode should be set on the vswitch/port in VMware (assuming this is the virtualization technology you're using).



    ------------------------------
    Dusan VIDOVIC
    ------------------------------



  • 3.  RE: Qflow 1299 question

    Posted Fri March 10, 2023 03:18 AM

    Hi Dusan, yeah, the vmware part is done. I was expecting that after that I will see the interface in PROMISC but I am not. I tried add one Qflow into deployment and I do now see the interface is in PROMISC. I think the "deploy changes" was needed for it to show/activate. I will confirm the need to deploy changes today after adding more new Qflows as part of deployement and new "deploy changes"



    ------------------------------
    tysa
    ------------------------------