HP BladeSystem Dual NC370i - Multifunction Network... Manuel utilisateur

HP ProLiant Essentials Intelligent Networking

Pack Linux Edition

User Guide

Part Number 396352-00B

une 2007 (Second Edition)

The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express

warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP

shall not be liable for technical or editorial errors or omissions contained herein.

Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212,

Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S.

Government under vendor’s standard commercial license.

Audience assumptions

This document is for the person who installs, administers, and troubleshoots servers and storage systems.

HP assumes you are qualified in the servicing of computer equipment and trained in recognizing hazards

in products with hazardous energy levels.

Contents 3

Contents

Overview..................................................................................................................................... 4

HP ProLiant Essentials Intelligent Networking Pack -Linux Introduction ............................................................... 4

Intelligent Networking Pack licenses............................................................................................................. 4

Linux operating system requirements .................................................................................................. 5

Downloading files ........................................................................................................................... 5

Installing the INP rpm packages .................................................................................................................. 5

Installing an INP license ............................................................................................................................. 5

Using Virus Throttle ....................................................................................................................... 7

How Virus Throttle works............................................................................................................................ 7

Starting Virus Throttle................................................................................................................................. 7

Configuring Virus Throttle parameters .......................................................................................................... 8

Monitoring Virus Throttle status.................................................................................................................... 8

Stopping Virus Throttle ............................................................................................................................... 9

Restarting Virus Throttle.............................................................................................................................. 9

Log and Event File ................................................................................................................................... 10

Troubleshooting.......................................................................................................................... 11

Potential solutions for INP configuration problems........................................................................................ 11

Installing an Intelligent Networking Pack license ................................................................................ 11

Using Virus Throttle........................................................................................................................ 11

Technical support........................................................................................................................ 13

Before you contact HP.............................................................................................................................. 13

HP contact information............................................................................................................................. 13

Free automated customer support services .................................................................................................. 13

Acronyms and abbreviations........................................................................................................ 15

Index......................................................................................................................................... 16

Overview 4

Overview

In this section

HP ProLiant Essentials Intelligent Networking Pack -Linux Introduction ............................................................. 4

Intelligent Networking Pack licenses ........................................................................................................... 4

Installing the INP rpm packages................................................................................................................. 5

Installing an INP license ............................................................................................................................ 5

HP ProLiant Essentials Intelligent Networking Pack -

Linux Introduction

The HP ProLiant Essentials Intelligent Networking Pack-Linux Edition is part of the ProLiant Essentials

software family and is integrated with HP Systems Insight Manager (SIM), SmartStart, and HP

Management agents.

The Intelligent Networking Pack (INP) includes Virus Throttle, a network packet-filtering feature that helps

slow down the spread of viruses on your system. Virus Throttle monitors all outbound connection requests

and counts the number of unique connections. It detects abnormal ("virus-like") behavior in the requests,

and slows down excessive connection requests to new hosts until you can determine if they are viral in

nature and take action.

The INP features are included with the networking software (release 8.10 and higher). To enable the INP

features, an INP license must be installed on the system. This user guide describes how to install these

licenses on your system and how to configure the features.

For the latest driver, firmware, and documentation updates, go to HP Networking website

(http://h18004.www1.hp.com/products/servers/networking/index.html).

Intelligent Networking Pack licenses

Each server requires a separate INP license. When installed on the system, the license is "attached" to the

server and cannot be revoked. The license will stay with that server for the life of the server. The license is

associated with the server's serial number, so a change in the server's name or IP address will not

invalidate the license. One INP license enables all INP features on the server.

Four categories of INP licenses are available. Each license offers full, unlimited functionality.

•Single license pack—Authorizes one licensed seat.

•Flexible Quantity license pack—Authorizes the set number of licensed seats ordered.

•Activation Key Agreement license pack—Allows you to authorize additional licensed seats under the

terms of a signed and implemented Activation Key Agreement (AKA) only.

•Demo—Allows you to evaluate the features for a set number of seats and a set number of days

Overview 5

Linux operating system requirements

To install and enable Virus Throttle on your server, you need the following:

•Two INP rpm packages (release 8.10 or higher) located on the HP website (http://www.hp.com)

ohp-pel. Contains the HP ProLiant Essentials INP licensing utility (nalicense)

ohp-vt. Contains the HP Virus Throttle for Linux application

•An INP license activation key, located on the back of the HP ProLiant Essentials Intelligent

Networking Pack Kit

Downloading files

1. Go to the HP website (http://www.hp.com).

2. Click Software & Driver Downloads from the left menu bar.

3. Type the product name in the For product box and press Enter. For example, type NC370T.

4. Select an operating system.

5. Click HP ProLiant Networking Software.

6. Click download and save the HP SoftPaq (sp#####.exe) file to a directory on your hard drive. The

SoftPaq file is a self-extracting executable with a file name based on the SoftPaq number.

Installing the INP rpm packages

The INP licensing (hp-pel) package must be installed on your system before the Virus Throttle (vt pel)

package can be installed.

To install the rpm packages:

1. Download the SoftPaq as described above.

2. Navigate to the Linux Virus Throttle directory.

Example:

# cd linux/hp-vt

3. Install the licensing rpm package (hp-pel).

# rpm -Uvh hp-pel-<version>.<operating system>.linux.rpm

4. Install the Virus Throttle rpm package (hp-vt).

# rpm -Uvh hp-vt-<version>.<operating system>.linux.rpm

The INP licensing utility and Virus Throttle packages are now installed. The next step is to install your INP

license.

Installing an INP license

Use the following command to add the license key to your system:

/opt/hp/hp-pel/nalicense -a <license_string> [-l <log-file>]

Overview 6

Argument Description

-a <license_string> Valid INP license activation key. The string

must be entered in dash separated form, such

as DE9DF-VHDL9-7SLR8-73LOS-OSM3K

[-l <log-file>] Optional parameter specifying a location to

write successful or error messages.

-d Displays information about an INP license

installed on your system. For example,

/opt/hp/hp-pel/nalicense –d

-h or --help Displays usage information.

For example, the following command adds the license to the system:

nalicense -a DE9DF-VHDL9-7SLR8-73LOS-OSM3K

Upon successful operation writes the following message to STDOUT:

“Mon Sep 15 15:42:14 2003: Adding License “DE9DF-VHDL9-7SLR8-73LOS-OSM3K”.

Success”

HP recommends that you retain the license key for future use. The key is needed for technical support and

future upgrades.

Using Virus Throttle 7

Using Virus Throttle

In this section

How Virus Throttle works........................................................................................................................... 7

Starting Virus Throttle................................................................................................................................ 7

Configuring Virus Throttle parameters......................................................................................................... 8

Monitoring Virus Throttle status .................................................................................................................. 8

Stopping Virus Throttle.............................................................................................................................. 9

Restarting Virus Throttle............................................................................................................................. 9

Log and Event File .................................................................................................................................. 10

How Virus Throttle works

Viruses typically spread by connecting to as many different machines as possible. Virus Throttle, a

network packet-filtering feature, monitors all outbound connection requests and helps to stop the spread of

viruses on your system by detecting abnormal ("virus like") behavior in the requests. It slows down

excessive connection requests to new hosts until you can determine if they are viral in nature and take

action.

When you install Virus Throttle on your system, the Virus Throttle iptable_filter and ip_queue modules are

loaded and a QUEUE target is created so all connection requests pass through it. The driver maintains a

delay queue of connection requests and a list of known hosts that have established connections.

The driver examines all outbound connection requests and determines if the request is for a known host. If

known, the request is passed down the protocol stack as a normal request. If the request is unknown, it is

added to the delay queue. Periodically, the delay queue is examined, and the oldest request and all other

connection requests to that same host are removed and passed down the protocol stack.

A high water mark and low water mark are maintained for the delay queue and are used to determine

when "virus-like" behavior is occurring or has stopped.

•When the rate of connection requests exceeds the rate of the driver removing them from the delay

queue, a high water mark in the queue is exceeded, and the driver indicates "virus-like" activity.

•When the rate of connection requests slows so that the number of queue entries falls below a low

water mark, the driver indicates that the "virus-like" activity has stopped.

When "virus-like" activity is detected or has stopped, Virus Throttle logs an event. If HP Management

agents are installed and configured correctly, a Simple Network Management Protocol (SNMP) trap will

be sent.

Starting Virus Throttle

By default, Virus Throttle is configured to start on system boot-up. To start Virus Throttle immediately after

installation, run the following command:

# /etc/init.d/hp-vt start

Using Virus Throttle 8

Virus Throttle requires both the iptable_filter and ip_queue modules. If both modules are not installed on

the system when Virus Throttle is started, an error message is displayed. Currently, only one application

may register for the iptables QUEUE target. If another application has already registered for the QUEUE

target, an error message is displayed.

Configuring Virus Throttle parameters

When you first install Virus Throttle the configuration parameters for the filter driver are set to the defaults.

Changes to the configuration file can be made with any text editor. However, Virus Throttle must be

restarted before any changes can take affect. See Restarting Virus Throttle.

The Virus Throttle configuration file is located at

# /etc/opt/hp/hp-vt/hp-vt.conf

The following default parameters can be edited:

•delay_queue_size=200

Controls the maximum number of delayed connection requests in the delay queue. When the queue

is full, connection requests are dropped. The default is 200 delayed connection requests. The valid

range is 10–1000.

•delay_queue_high_watermark=160

Controls the number of connection requests in the delay queue at which "virus-like" activity is

considered to be occurring. The default is 160 connection requests. The valid range is 8–the value of

delay_queue_size.

•delay_queue_low_watermark=100

Controls the number of connection requests in the delay queue below which "virus-like" activity is

considered to be stopped. The default is 100 connection requests. The valid range is 4–the value of

delay_queue_high_watermark minus 4.

•delay_queue_delay_seconds=1

Controls the rate at which the oldest connection request and all other connection requests to that

same host are passed down the protocol stack. The default is 1 second. The valid range is 1–10

seconds.

•host_working_set_size=5

Controls the number of known hosts to which connections are established without delay. When a

new connection is made, the oldest member of the working set is replaced with the new host. The

default is 5 hosts. The valid range is 1–100.

•shared_memory_key=0x48505654

Used in shmget calls, and should not normally be changed. An example of when this key may need

to be changed is if there is a conflict with another application using the key. If the key is changed,

the hp-vt status will not work until hp-vt has been restarted. The format of the key is four bytes in hex

that start with “0x,” in other words 0x48505654. To show the shared memory segments currently in

use, run ipcs –m. The default value is hex representing ascii “HPVT”.

Monitoring Virus Throttle status

When Virus Throttle is running, use the following command to display the status:

# /etc/init.d/hp-vt status

Using Virus Throttle 9

The overall status, statistics, and delay queue information since the Virus Throttle filter driver was

initialized is displayed.

Status information

•Virus-like activity is currently occurring. "Virus-like" activity is currently detected.

•Virus-like activity has not occurred. No "virus-like" activity is currently detected and none has been

detected since the filter driver was initialized.

•Virus-like activity has occurred in the past. No "virus-like" activity is currently detected, but "virus-

like" activity has been detected since the filter driver was initialized.

Statistics

•Connection establishing packets. Number of connection packets seen.

•Packets passed without delay. Number of connection packets that were passed without a delay

because the target was a known host.

•Packets placed on queue. Number of connection packets queued.

•Packets removed from queue. Number of connection packets removed from the delay queue.

•Currently queued packets. Number of connection packets currently on the delay queue.

•Maximum packets on queue. Maximum number of packets on the queue at any point since Virus

Throttle was last started.

•Times virus-like activity seen. Number of times "virus-like" activity was detected.

•Packets dropped due to queue overflow. Number of packets that were dropped due to the delay

queue being full.

Configuration information

•Delay queue size. The maximum number of connection requests in the delay queue.

•Delay queue seconds. The rate at which the oldest connection request and all other connection

requests to that same host are removed and passed down the protocol stack.

•Known host working set size. The number of known hosts.

•Delay queue high water mark. The number of connection requests in the delay queue at which point

"virus-like" activity is indicated.

•Delay queue low water mark. The number of connection requests in the delay queue below which

"virus-like" activity is no longer indicated.

Stopping Virus Throttle

To manually stop Virus Throttle, run the following command.

# /etc/init.d/hp-vt stop

Restarting Virus Throttle

Run the following command to restart Virus Throttle.

# /etc/init.d/hp-vt restart

Using Virus Throttle 10

Log and Event File

All messages are logged to /var/opt/hp/hp-vt/hp-vt.log.

To display the log file, run the following command in a separate window:

# more /var/opt/hp/hp-vt/hp-vt.log

Message format

Log messages are displayed in the following format [TAG] SP [DATE] SP TEXT, where:

•[TAG] is one of the following. Lines that do not begin with a tag are a continuation of the previous

line.

oALERT_VLA_DETECTED. Indicates virus-like activity detected.

oALERT_VLA_STOPPED. Indicates virus-like activity has stopped.

oDROPPING_CONNECTIONS. Indicates connections are being dropped. After this event is logged,

it will not be logged again until the low water mark is reached.

oERROR. Indicates errors, such as out of range configuration parameters in hp-vt.conf.

oWARNING. Indicates warnings, such as not being able to load the ip6_queue module.

oINFO. Indicates informative events, such as HP LVT starting and stopping

•SP is one or more spaces

•[DATE] is the current date stamp in the following format:

Thu Feb 10 12:54:35 CST 2005

•TEXT is free-form text that may or may not exist for every message

Message example

The following is an example message.

[INFO] [Thu Feb 10 10:34:15 CST 2005]…hp-vt started

[ALERT_VLA_DETECTED] [Thu Feb 10 12:54:35 CST 2005]

[INFO] [Thu Feb 10 12:54:36 CST 2005]

first text line of second info message

second text line of second info message

[ALERT_VLA_STOPPED] [Thu Feb 10 12:54:58 CST 2005]

Autres manuels pour BladeSystem Dual NC370i - Multifunction Network...

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels HP Logiciel

HP T5725 - Compaq Thin Client Manuel utilisateur

HP Data Protector A.06.11 Guide de configuration rapide

HP BladeSystem Dual NC370i - Multifunction Network... Manuel utilisateur

HP 6300C - ScanJet - Flatbed Scanner Manuel utilisateur

HP A4500A - VMEbus Single Board Computer 744... Mode d’emploi

HP INSIGHT DYNAMICS T8671-91017 Manuel utilisateur

HP Compaq Presario,Presario 4400 Mode d’emploi

HP ProCurve J8766A Mode d’emploi

HP BB118BV - StorageWorks Data Protector Express... Instructions d'installation et d'utilisation

HP StorageWorks 8B - FC Entry Switch Manuel utilisateur

HP 460C - Deskjet Color Inkjet Printer Manuel utilisateur

HP SN3000B Manuel de service

HP BL680c - ProLiant - G5 Guide rapide

HP Xw4300 - Workstation - 2 GB RAM Guide de référence rapide

HP ProLiant DL320e Manuel utilisateur

HP Compaq NC4000 Manuel du propriétaire

HP StorageWorks 1510i - Modular Smart Array Manuel utilisateur

HP StorageWorks 2/64 - Core Switch Manuel utilisateur

HP Integrity rx5670 Manuel utilisateur

HP T1936AA - Digital Sending Software Instructions d'installation

HP NetServer AA 6200 Manuel de service

HP vc4825T - Thin Client Manuel de service

HP Brio BA200 Manuel utilisateur

HP AK373A - StorageWorks All-in-One Storage System 1200r 5.4TB SAS Model NAS... Comment utiliser

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Novell

Novell SP2 - S Mode d’emploi