Install the Virtual Probe

To install the Virtual Probe on your Linux machines as a root user, follow the steps below.

1. Move the downloaded Probe Installation Package vIPS_Probe_Linux.tar.gz into an appropriate folder.
2. To unzip the package, execute the command tar xzf vIPS_Probe_Linux.tar.gz
3. To install the package, run the command ./install.sh
   The Virtual Probe is now installed on your Linux machine.
4. To verify the Probe installation, execute the command service trellix_vips_probe status
5. (Optional) To start the service after it is stopped, execute the command sudo service trellix_vips_probe start
6. (Optional) To restart the Probe, execute the command sudo service trellix_vips_probe restart
7. (Optional) To stop the service, execute the command sudo service trellix_vips_probe stop
8. To verify if the Probe is successfully installed, perform the following steps:
   1. Click Analysis → Virtual Machines. This displays the Virtual Machines page.
   2. Check the state of the Probe in the State column of vIPS Probe. If the Probe is successfully running, the status is green in color.
      You can also run the stats_client.py script in sudo mode for checking the inspected traffic statistics on the virtual machines. The stats_client.py script is used to confirm and troubleshoot connectivity with the other components. The script displays details, such as Sensor details, inspection mode, and Controller status. Sample output for stats_client.py script is given below:

      Packets read from queue[0]: 561825
      Bytes read from queue[0]: 321796393
      Time waiting for packets from queue(ns): 26871840090079
      Timed out reading packet from queue: 4723
      Packets accepted[0]: 561339
      Packets rejected[0]: 486
      Time spent in verdicting(ns)[0]: 9441122857
      Packets send to node[0]: 561082
      Bytes send to node[0]: 333875820
      Pings sent to node[0]: 11115
      Packets received from node[0]: 560596
      Bytes received from node[0]: 333375590
      Time spent waiting to read from sensor(ns): 26803282492008
      Time receiving packets from node(ns)[0]: 1870116120
      Ping responses received[0]: 11115
      Failed open after sending to sensor: 743
      Queue Number[0]: 1
      Node Address[0]: 10.1.1.1
      Probe Id: f37d39e7-3517-4934-a82a-e5a42b3992e5
      Inspection Mode: ips
      Failure Handling: fail_open
      Control State: CONTROLLER_CONNECTED
      IPv4 packets: 561815
      IPv6 packets: 10
      TCP packets: 556894
      UDP packets: 4921
      Netfilter Queue Statistics
      ==========================
      Q[1]: total pkts = 561082 current queued = 0, q_drops = 0, msg_drops = 0

      Note

      The script requires Python for Windows version 2.x for it to work.

To install the Virtual Probe on your Windows Virtual Machines as an administrator, follow the steps below.

1. Move the downloaded Probe Installation Package vIPS_Probe_Windows.zip into an appropriate folder.
2. Navigate to the folder where your Probe Installation Package is installed and unzip it.
3. At the command prompt, navigate to the location of your batch file and run it using the command install.bat azure.
4. The command window will hang for a few seconds and disappear. This indicates the completion of the installation process.
   You must run stats_client.py script in sudo mode for checking the inspected traffic statistics on the virtual machines. Sample output for stats_client.py script is given below:

   Trellix vIPS Probe Statistics
   ================
    Packets read from queue[0]: 84522
    Bytes read from queue[0]: 31580372
    Time waiting for packets from queue(ns): 6532663311061
    Timed out reading packet from queue: 1660
    Packets accepted[0]: 84522
    Time spent in verdicting(ns)[0]: 1034205135
    Failed open after sending to sensor: 84522
    Queue Number[0]: 1
    Probe Id: 3985126c-378c-44cc-a4d9-4b9bca3e4r5t
    Inspection Mode: ips
    Failure Handling: fail_open
    Control State: CONTROLLER_CONNECTED
    IPv4 packets: 84512
    IPv6 packets: 10
    TCP packets: 83011
    UDP packets: 1501
    Netfilter Queue Statistics
   ==========================
    Q[1]: total pkts = 80528 current queued = 0, q_drops = 0, msg_drops = 0