By: Justin Borland, Equifax
Requirements:
First, acquire the following software from Solarflare support:
- OpenOnload Release Package
- Solarflare Linux Utilities RPM (64bit)
- SolarCapture SDK
- Solarflare Flareon Ultra card already physically installed on a server running CentOS
Implementation steps:
SolarFlare SDK install:
# unzip solar_capture_sdk-.zip
# rpm –Uvh sfutils-*.rpm
OpenOnload build:
# tar –xf openonload-.tgz
# cd openonload-
# onload_uninstall && ./scripts/onload_install
Note that if any capture processes are already running (i.e. Moloch, Bro, Snort or Suricata) kill them before reloading, and keep them off until the end of this install.
# onload_tool reload
# cd ..
SolarCapture Core installation:
# rpm –Uvh solar_capture-core-.rpm
SolarCapture Python install:
# yum install rpm-build
# rpmbuild –rebuild solar_capture-python-.src.rpm
# rpm –Uvh /root/rpmbuild/RPMS/x86_64/solar_capture-python-.rpm
SolarCapture Pro installation:
# rpm –Uvh –replacepkgs solar_capture-live-.rpm solar_capture-pro-.rpm
Update the NIC firmware
# sfupdate –write
Note that you should answer ‘Y’ for each NIC.
Restart capture services
# /wherever/your/capture/script/lives_start.sh
Verify Install:
Check installed packages
# rpm –qa | grep capture
You should now see this:
solar_capture-core-1.3.1.11-0.x86_64
solar_capture-pro-1.3.1.11-0.x86_64
solar_capture-python-1.3.1.11-0.x86_64
solar_capture-live-1.3.1.11-0.x86_64
Check NIC licensing
# sfkey
Which should then look like this:
2-interface adapter: eth4, eth6
Product name: Solarflare SFN7122F SFP+ Flareon Ultra Server Adapter
Part number: SFN7122F
Serial number: 712200210071141137100559
MAC addresses: 00-0F-53-xx-xx-xx, 00-0F-53-xx-xx-xx
Installed keys: Onload
Active keys: Onload
Blacklisted keys: 0
Invalid keys: 0
Unverifiable keys: 0
Inapplicable keys: 0
One final note, Solarflare Support has not yet validated the above steps so please use at your own risk.