NIMS Online Help

Previous Next

NIMS Online Help
NIMS Online Help
Welcome to the Network InstrumentsOnline Help. Thank you for choosing Network Instruments’ products to monitor your network. With our tools you can more easily and efficiently monitor and manage your network and network applications.
Whether you use our products on your laptop or one of our many purpose-built appliances, you will find plenty of resources in this online help system.
NIMS
Getting started with NIMS
General tab
Managing probe and Observer licenses
Adding a license
Configuring Observer analyzers to use NIMS security
Configuring probes to use NIMS security
Running NIMS as a Windows service
How to create a user group
How to add users to a user group
Defining a failover NIMS
Defining probe access permissions
Configuring how user accounts should authenticate
Licensing the probes or Observer analyzers
Importing a license
How to create an entity group
How to auto-upgrade Observer
Table 1. Contact Support
By Phone
To speak with a member of our Technical Support department, please call:
US: 1-800-526-7919 (CST/CDT)
Europe: +44 (0) 1959-569880 (GMT)
Outside the US & Europe: +1 952 358-3800
Telephone technical support hours are between 9:00 a.m. and 5:00 p.m.
(local time for each office).
By E-Mail
If you cannot find the information you are looking for on these pages, please e-mail our support department at:


About NIMS

About NIMS
About NIMS
Getting started with NIMS
Follow these steps to get started using NIMS. This section assumes you do not have NIMS installed and provides the information to take you from an empty NIMS system to fully configured.
1.
Install the software. See Installing NIMS software.
2.
Ensure you have generated the shared keys required by NIMS and distributed those keys to the probes and Observer analyzers. See Using Observer and probe software with NIMS.
3.
Add or create users. See How to add new users.
4.
Add your probe and Observer analyzer licenses to NIMS. See Managing probe and Observer licenses.
At this point you have a basic setup where users can access probes and Observer analyzers. You can further create user and entity groups to fine tune access permissions.
5.
Create user groups. See Understanding user groups.
6.
Create entity groups. See Understanding entity groups.
You can also configure other options about the NIMS software, such as whether it runs as a Windows service, uses a failover server, pushes software upgrades to the probes andObserver analyzers, and more.
7.
Choose whether NIMS should run as a Windows service. See Running NIMS as a Windows service.
8.
If you want to use a second NIMS system as a failover, see Using a failover NIMS.
9.
If you want NIMS to push any software updates to the probes or Observer analyzers, see How to auto-upgrade Observer.
10.
If you want to share packet or capture filters across all Observer analyzers, see Sharing filters.
11.
If you want to limit the login attempts a user may attempt before locking their account, see Setting failed login attempt limits and notifications.
12.
To be notified by e-mail or page about certain events, see Configuring e-mail server and pager settings.
13.
To learn about the Event Log tab, see Using NIMS Event Log.


What does NIMS do?

About NIMS > Getting started with NIMS > What does NIMS do?
What does NIMS do?
Network Instruments Management Server (NIMS) simplifies probe administration, management, security, and maintenance for IT professionals responsible for maintaining multiple Network Instruments probes andObserver analyzers across an enterprise network. For network managers, NIMS offers added security, centralized licensing, a centralized update service, and failover redundancy. For network administrators, NIMS provides shared access to analysis tools, including Observer and probe filter libraries.
NIMS maintains a central database of user accounts. A NIMS-enabled probe contacts NIMS whenever access to that probe is requested. The Observer analyzer is not allowed to connect unless the correct user name and password are presented. What the user is allowed to do with the probe (redirect, capture packets, and so on) depends on how you have configured NIMS.
Figure 1. Centralized access management
Use NIMS to:
*
Authenticate users for probe access from one central location.
*
Define probe rights by individual users, user groups, or entity groups.
*
Manage user passwords and permissions globally.
*
Redundant NIMS provides fail-safe license acquisition; if a NIMS server is down, analyzers and probes can still acquire license from a secondary NIMS server if you have made one available.
*
Utilize a Centralized Update System to efficiently administer version upgrades.
*
Share filters with Observer users across the network. Synchronize the selected filters to NIMS from any Observer analyzer or probe. The resulting shared filter library is then available to any system under NIMS management.
*
License new probes automatically as they connect into the network.
*
Maintain a log of all probe access activity.
*
Serve SSL private keys for traffic decryption using a hardware security module (HSM).
NIMS uses a number of entities that allow you to control probe access lists and user permissions. NIMS’ user authentication supersedes any security options configured on the probe’s Security tab. The entities are described in Table 1.
Table 2. NIMS entities
Entity
Description
User
Consists of a user name and Password, which can be entered manually into NIMS, or automatically updated by referring to the local Windows system account, anActive Directory, or RADIUS Server. If the user has been imported, you cannot change the user name and password through NIMS; you must use the appropriate administrative tools at the source to edit the account and then choose Options > Update Users from NIMS main menu.
Unlike user accounts maintained by probes locally, NIMS Users have no access permissions directly associated with them. A user’s access permissions are defined by membership in a user group.
User Group
A user group is a list of users with the same access permissions. You can think of membership in a user group as a ticket that allows a user access to any probe that recognizes the ticket. If you have no need to vary levels of access based on the user, you do not need to add or maintain user groups; simply add all users to the default user group and set permissions on that group as desired.
Probe
In the context of NIMS, a probe means “any Network Instruments probe that has NIMS authentication enabled.” Users are not directly added to a probe’s access list. In NIMS, a probe controls what Users are allowed access by being a member of an entity group, which in turn maintains an access list of user groups.
Entity Group
An entity group is a collection of probes, Observer analyzers, Observer Reporting Server instances, and Observer Infrastructure instances that allows user access only if the user’s NIMS user group has been added to the entity group’s access list. This provides a mechanism to grant different access permissions to the same user depending on what probe that user is being authenticated for. You can disable entity groups from Options > Management Server Options.


Installing NIMS software

About NIMS > Getting started with NIMS > Installing NIMS software
Installing NIMS software
Supported operating systems include:

Windows XP (32-bit SP3, 64-bit SP2)

Windows Vista (32-bit SP1 or higher, 64-bit SP1 or higher)

Windows 7 (32-bit SP1 or higher, 64-bit SP1 or higher)

Windows Server 2003 Enterprise, Standard, Web (32-bit SP3 or higher, 64-bit SP3 or higher)

Windows Server 2008 Enterprise, Standard, Web (32-bit SP2 or higher, 64-bit SP2 or higher)

Windows Server 2008 R2 Enterprise, Standard, Web (SP1 or higher)

To install the NIMS software, follow these steps:
1.
Insert the installation CD in your CD drive or use the latest installation image from our FTP site. If you copied the installation files from our web site, start the installation program.
ftp://ftp.networkinstruments.com/pub/demos/
2.
When the setup program runs, follow the onscreen instructions.
3.
Start NIMS and provide your NIMS license information.
Now that NIMS is installed and licensed, you must create and distribute a shared encryption key that all probes and Observer analyzers must use to authenticate with NIMS.
4.
Click Launch Encryption Key Utility to create a key. Distribute the key in a secure manner to all of the authorized Observer or probe systems.
5.
After you generate an encryption key, the Authentication dialog appears. This dialog lets you specify the method for generating a list of valid users.
See Configuring how user accounts should authenticate.
Ports used by Network Instruments products
Network Instruments probes and Observer use TCP port 25903 to transfer data and commands between the probe and the Observer analyzer. You may need to modify your firewall rules to allow communication on these ports forObserver.
NIMS (which authenticates probe/analyzer connections via a central server) uses TCP 25903 and UDP 25903.
Functionality
Ports
Redirection/connection request
TCP 25903
Probe administration
TCP 25903
Analyzer–Probe connection
TCP 25901
NIMS User ID validation
UDP 25903
NIMS license validation
TCP 25903


NIMS technical specifications

About NIMS > NIMS technical specifications
NIMS technical specifications
Figure 2. NIMS
Figure 3. NIMS
Figure 4. NIMS dimensions
Platform
19-inch rack-mountable probe appliance that captures your gigabit network traffic and perform high-speed analysis utilizing the Gen2 capture card.
Memory
8 GB RAM
Capture card
Custom-designed, full-duplex Gen2 Gigabit Capture Card
Hard drive
500 GB / 7200 RPM
Power consumption
Input voltage: 100V-240V auto select
Input frequency: 50/60Hz
240w (819 Btu/h)
Operating Temperature Range
32° F (0° C) to 104° F (40° C)
Dimensions
19 in (W) x 2.28 in (H) x 18.5 in (mounting depth)
(Full probe depth with handles: 20.4 in)
48.26 cm (W) x 5.79 cm (H) x 46.99 cm (mounting depth)
(Full depth with handles: 51.82 cm)
Weight
40 lbs (18.1 kg)
Operating system
64-bit Windows 7


Integrating Probes and Analyzers and Keeping Redundancy

Integrating Probes and Analyzers and Keeping Redundancy
Integrating Probes and Analyzers and Keeping Redundancy
Using Observer and probe software with NIMS
Observer is the same program with or without NIMS management features; the only Observer features affected are security andfilters. If you are using NIMS to manage licenses or share filters, you must configure your probes and analyzers to connect to NIMS.


Configuring Observer analyzers to use NIMS security

Integrating Probes and Analyzers and Keeping Redundancy > Using Observer and probe software with NIMS > Configuring Observer analyzers to use NIMS security
Configuring Observer analyzers to use NIMS security
There are several options available to you to tighten access to the Observer analyzer. Many of the options are used in conjunction with NIMS, but some can be used by the Observer analyzer by itself.
1.
To view and change the security settings for an Observer analyzer, in the Observer analyzer choose Options > Observer General Options > Security. Use the information in Table 1 to configure the analyzer’s security and NIMS options.
After completing this task:
Table 3. Security options
Option
Description
Require Observer Login
When enabled, this option forces a user to provide a user name and password to open the Observer analyzer. The user name can be stored locally if you are not using NIMS, or maintained by NIMS if the “Authenticate Observer login with NIMS” option is enabled. This option is not visible unless you have a special license enabling it.
Observer Login Credentials—Type a user name and password. This information is encrypted and stored locally. Only one user account is allowed per system. If you want numerous people to have access to the Observer analyzer with different user accounts, you must use NIMS.
Administrative Credentials—A local administrative user account that allows you to create a non-administrator account and to set security options for NIMS. Do not lose this password! There is no way to recover a lost administrative password.
Use Observer Encryption Key file for secure connections
Strong encryption is available for Observer Expert and Observer Suite users. Observer Encryption Key (.OEK) files let you use private encryption keys to ensure that unauthorized persons do not have access to the data flowing between Observer analyzers and probes.
To use Observer Encryption Key files, you must copy the encryption key file into the installation directory (usually C:\Program Files\Observer) of each probe or analyzer that you want to authorize. To generate a key file, click the “Launch Encryption Key Generator”button. Its online help explains its use and how to set up the keys it generates.
Each analyzer and each probe must have the .oek file. Observer encryption keys are required if you want to use NIMS.
Authenticate users (of redirected Probe instances)
Forces users to authenticate with NIMS before using remote probes. User accounts belong to user groups in NIMS and through the user groups access to probe instances can be granted or restricted. Only probe instances to which the user has access will be visible in the analyzer. This option does not control whether users can openObserver. That is done through the “Authenticate Observer login with NIMS” option.
Manage Observer /Probe licenses with NIMS
An Observer or probe license can be stored and managed locally at each analyzer or probe, or it can be managed centrally by NIMS. If unchecked, it is managed locally and you must provide a license for each analyzer/probe. If selected, then you can provide a pool of licenses in NIMS and the analyzer or probe will take an available license when the analyzer or probe starts.
Get list of Probe Instances available for redirection from NIMS
When enabled, all probe instances to which you the user has access to through group permissions set in NIMS are available when connecting to a probe. When disabled, only the local probe instances are available and no probe instances are listed when connecting to a remote probe.
Share filters with NIMS
When enabled, users may create filters and share them with others. They can also get any filters created by others. Whenever a filter is updated, they can be informed and update their local version. The list is maintained by NIMS.
Synchronize user protocol definitions through NIMS
When enabled, protocol definitions are managed by Network Instruments Management Server (NIMS). All Observer analyzers using this setting share the same protocol definitions.
Primary/Secondary server
Provide the IP address of the primary NIMS server. If you are also using a failover NIMS server, type its IP address in the Secondary server box.
Allowed to modify shared filters
When selected, you can get a shared filter from someone else, modify it locally, then upload your modified version to NIMS thereby making your new version available to everyone else. When unchecked, you can only get filters from NIMS and upload your own. You cannot modify any filters you get from NIMS. This option requires that you have the ability to share filters with NIMS.
Authenticate Observer login with NIMS
This option works in conjunction with the “Require Observer Login” option. This forces Observer to use NIMS to authenticate users rather than Observer’s local user list. A user list is maintained in NIMS.
Require a password to change partial packet capture size
Select this option if you want to require someone to provide a password before they may change the partial packet capture size. This is a central password and all users must use the same password.
Launch Encryption Key Generator
Click this button to open the Network Instruments encryption key generator. If you want the GigaStor payload to be encrypted using 256 bit AES encryption before it is stored, select the “EncryptGigaStor network traffic…” option.
An encryption key is needed on the GigaStor (or a location accessible by the GigaStor ) to encrypt and decrypt the data. The AES key is not needed on workstations, probes, or other collection points. A special license is required for this feature. Contact Network Instruments for this license.


Configuring probes to use NIMS security

Integrating Probes and Analyzers and Keeping Redundancy > Using Observer and probe software with NIMS > Configuring probes to use NIMS security
Configuring probes to use NIMS security
There are several options available to you to tighten access to a Multi Probe or Expert Probe. Single Probes cannot be secured. Many of the options are used in conjunction with NIMS, but some can be used with the Observer analyzer without NIMS.
1.
To view and change the security settings for a probe, in the probe choose Options > Probe Options. Use the information in Table 1 to configure the probe’s security and NIMS options.
After completing this task:
Table 4. Probe security options
Option
Description
Use Observer Encryption Key file for secure connections
Strong encryption is available for Observer Expert and Observer Suite users. Observer Encryption Key (.OEK) files let you use private encryption keys to ensure that unauthorized persons do not have access to the data flowing between Observer analyzers and probes.
To use Observer Encryption Key files, you must copy the encryption key file into the installation directory (usually C:\Program Files\Observer) of each probe or analyzer that you want to authorize. To generate a key file, click the “Launch Encryption Key Generator”button. Its online help explains its use and how to set up the keys it generates.
Each analyzer and each probe must have the .oek file. Observer encryption keys are required if you want to use NIMS.
Use NIMS for user authentication
This option works in conjunction with the “Require Observer Login” option. This forces Observer to use NIMS to authenticate users rather than Observer’s local user list. A user list is maintained in NIMS.
Manage Observer /Probe licenses with NIMS
An Observer or probe license can be stored and managed locally at each analyzer or probe, or it can be managed centrally by NIMS. If unchecked, it is managed locally and you must provide a license for each analyzer/probe. If selected, then you can provide a pool of licenses in NIMS and the analyzer or probe will take an available license when the analyzer or probe starts.
Primary/Secondary server
Provide the IP address of the primary NIMS server. If you are also using a failover NIMS server, type its IP address in the Secondary server box.


Sharing filters

Integrating Probes and Analyzers and Keeping Redundancy > Using Observer and probe software with NIMS > Sharing filters
Sharing filters
The Shared Filters tab lists any filters that have been synchronized from an Observer analyzer authenticated with the Network Instruments Management Server.
For Observer analyzers to share filters, all of the following must be configured:
*
The shared filters feature must be enabled on each analyzer that is to participate in filter-sharing. From Observer’s main menu, choose Options > Observer General Options, then click the Security tab. Check the box labeled “Share filters with NIMS” and, optionally, “Allow to modify NIMS shared filters.” Provide the credentials (a valid user name and password on NIMS with permission to share filters enabled) for the user. This enables the “Shared Filters” folder in the Active Filters window.
*
Make sure that you have the user name and password entered also configured on NIMS. The user must belong to a group with permission to share filters.
If you have configured Observer to share filters with NIMS server, there is an additional folder added to Observer’s multi-filter selection dialog.
To share filters from your analyzer or get filters from other analyzers:
1.
In Observer, choose Actions > Filter Setup for Selected Probe. This opens the Active Filters window.
2.
Drag any filters you want to share into the Shared Filters folder.
3.
Select the Shared Filters folder and right-click. Choose Synchronize Shared Filters. Observer notices if you have any changed filters and notifies you.
4.
The Synchronize Shared Filter window opens. In it you can see the status of all of the shared filters available to you. A missing filter means you do not have a copy in your localObserver analyzer. A new filter means that you have it locally and have not yet uploaded it to NIMS to share. Click Synchronize to get and publish the latest versions of all shared filters.
5.
The Get Status button updates the status line below the list of shared filters. This status tells you if you need to synchronize (that is, you have new/updated filters to upload to the server, or there are filters stored in the server that you have not yet downloaded). If there is a need to synchronize, the Synchronize button is activated. Clicking the Synchronize button starts the synchronization process. The status line shows the progress of synchronization. Click Close when you are done.


Running NIMS as a Windows service

Integrating Probes and Analyzers and Keeping Redundancy > Running NIMS as a Windows service
Running NIMS as a Windows service
NIMS can run as a Windows service if you wish. Choose Options > Management Server Options > General. Running NIMS as a Windows service ensures that NIMS will always be loaded, even after a system restart due to a power outage or other problem.


Using a failover NIMS

Integrating Probes and Analyzers and Keeping Redundancy > Using a failover NIMS
Using a failover NIMS
You may choose to have one NIMS against which all probes and Observer analyzers authenticate, or you can choose to add a secondary or failover NIMS (licensed separately). This ensures that a license server is always available, thus preventing Observer downtime due to a hardware failure on the management server. The two NIMS systems will synchronize their configurations (that is, user accounts, group definitions, and so on).
Figure 5. Example of failover operation


Defining a failover NIMS

Integrating Probes and Analyzers and Keeping Redundancy > Using a failover NIMS > Defining a failover NIMS
Defining a failover NIMS
Follow these steps to configure NIMS to use two servers to maintain maximum uptime.
1.
Click Options > Management Server Options > General.
2.
Ensure “Use Primary-Secondary Configuration Servers” is selected.
3.
If this system should be the primary NIMS, check the “This server is a primary server” option.
4.
Provide the IP address of the other NIMS system.
5.
If this is the failover NIMS, set how often you want this NIMS to synchronize with the primary NIMS.


Becoming a primary/secondary NIMS

Integrating Probes and Analyzers and Keeping Redundancy > Using a failover NIMS > Becoming a primary/secondary NIMS
Becoming a primary/secondary NIMS
Prerequisite(s):
Ensure you have defined the secondary NIMS. See Defining a failover NIMS.
If you have two NIMS systems, follow these steps to switch roles of the NIMS systems. These instructions assume you want to promote the secondary server to the primary server.
1.
Click Options > Synchronize Configuration Now to ensure the systems share the latest information.
2.
Click Options > Negotiate to Become a Secondary Configuration Server.
The NIMS systems communicate and exchange roles.


Importing or exporting a NIMS configuration file

Integrating Probes and Analyzers and Keeping Redundancy > Using a failover NIMS > Importing or exporting a NIMS configuration file
Importing or exporting a NIMS configuration file
If you have two NIMS systems, you can synchronize the information between them by choosing Options > Synchronize now, which works well if you have already configured the two NIMS systems. However, if you simply want to duplicate configuration information without routinely synchronizing, then exporting and importing configuration information may be more appropriate for you. The configuration information includes users, entity groups, user groups, and license information.
When you import a configuration file, you completely replace any settings that you have with the settings from the configurations file; it is not an additive import action. This includes users, user groups, entity groups, e-mail server, authentication, and any other options.
1.
On system one, which has the configuration information you want, choose File > Export Configuration File. The Export Configuration File window opens.
2.
Save the file in a network location accessible by both systems, or put the file on a USB drive.
3.
On system two, choose File > Import Configuration File. Locate the file and click Open. The configuration from system one is imported into this system.


Troubleshooting common problems

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems
Troubleshooting common problems
Use the information in this section to assist you if you have a problem with your probe not connecting to your analyzer, your probe does not have a network adapter available, or if you are using an nTAP and want to capture NetFlow traffic.


A probe is not connecting to the analyzer or vice versa

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > A probe is not connecting to the analyzer or vice versa
A probe is not connecting to the analyzer or vice versa
If the probe is not connecting, it could be one of several reasons. The log window in the Observer analyzer has useful information to give you an idea of why the connection is failing. If the log window is hidden, choose View > Log Window to show it.
Verify the following:
*
Ports firewall and the traffic is actually passing through it. Observer uses these ports to communicate with the probe. Check any local system firewall as well as any network firewall.
*
Security and encryption settings match between the Observer analyzer and the probe. If the settings do not match, you will get a message that says “Probe redirection Error <IPAddress> Authentication Negotiation Error.” Either the security feature has been turned off for one side of the connection (but not the other), or their encryption keys do not match. In Observer, click Options > Observer General Options from the menu, then click the Security tab. On the probe, click the Security tab. Verify that the security properties match.
*
The user name you are using from the analyzer exists on the probe or in NIMS. Although very uncommon, the default “Anyone” account can disappear. If it does and you use that account to connect, your connections are prohibited. If the Anyone account has been deleted, you can recreate it on the probe by clicking the Security tab, then the New User button. Click the “Create Anyone Account” button.
If a Single Probe does not have a user name defined in the Options > Probe Redirection Settings, you must create a new account called “Anyone” (without quotes) and use that account to access the Single Probe.
*
The probe and Observer analyzer are within the same minor build range. You can have the Observer analyzer automatically force an upgrade of an older probe version.
*
You can access the VLAN if the probe or Observer analyzer are on different VLANs. There is nothing you need to configure inObserver or the probe to enable a connection when they are on different VLANs. However, if you do not have network permissions to access a probe on a different VLAN, it is a network configuration issue (usually for security reasons) and you should contact the network administrator.


Users cannot authenticate through NIMS

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > Users cannot authenticate through NIMS
Users cannot authenticate through NIMS
Verify the following:
*
The user account exists in NIMS.
*
Verify the user is a member of a user group with access to the probe.
After completing this task:
If after verifying the account exists with the access to the probe, restart NIMS.


Probe will not upgrade

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > Probe will not upgrade
Probe will not upgrade
If the probe software is running as a Windows service, you can choose to have the probe restart automatically. This is a configuration option in the probe’s settings and especially useful for remote probes where there is not a local administrator.


Probe is not being licensed

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > Probe is not being licensed
Probe is not being licensed
Since you have NIMS, you should use NIMS to centrally manage your probe and Observer analyzer licenses, especially if you use NIMS to push upgrades to the probes and analyzer. The probes should be running as a Windows service to properly upgrade. If they are run in application mode, rather than as a Windows service, then the restart will not occur. If for some reason a probe or analyzer was running in application mode when an upgrade occurred, you can close it and restart it. It should acquire an updated license from NIMS and functionality should continue as normal.


Licenses for different versions

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > Licenses for different versions
Licenses for different versions
NIMS can successfully handle licenses for different versions of Observer and the probes simultaneously. Assuming you want to have your licenses for version 14 and version 15 active, we suggest putting both the version 14 and version 15 licenses into NIMS. Allow NIMS to manage your licenses.
1.
To use this feature, in the Options > General Option of all your probes and analyzers, enable “Manage licenses with Network instruments Management Server” and ensure that the IP address of the NIMS is entered in the primary server field.
NIMS looks at the existing license on a probe to determine which type of license it requires. For example, if you have a probe with a version 14 Gigabit Probe license, when it connects to NIMS for the upgrade it pulls a new version 15 Gigabit Probe license. If you set up the probe to use an Expert Probe license, it uses another Expert Probe license. To do this, NIMS relies on the license that was originally used when the probe was installed.


NIMS failed to bind the authentication port

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > NIMS failed to bind the authentication port
NIMS failed to bind the authentication port
If you receive a message that NIMS failed to bind to the authentication port:
*
Ensure that ports 25901 and 25903 are open.
*
Ensure that you have the AuthenticationServerKey.oek in your NIMS, probes, and analyzer installation directories.


RADIUS servers not authenticating

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > RADIUS servers not authenticating
RADIUS servers not authenticating
Ifyour RADIUS servers are not authenticating or are locking out the users, try the following:
*
Try switching the primary and secondary RADIUS servers settings.
*
Increase the failed login attempt threshold.


I cannot see my co-worker’s shared filters

Integrating Probes and Analyzers and Keeping Redundancy > Troubleshooting common problems > I cannot see my co-worker’s shared filters
I cannot see my co-worker’s shared filters
If you cannot see your co-worker’s shared filters, be sure that you clicked Synchronize and, if necessary, the Get Status button. You may need to click the Synchronize button again after clicking Get Status.


General tab

Integrating Probes and Analyzers and Keeping Redundancy > General tab
General tab
The Options > Management Server Options > General tab allows you to set many basic functional settings for NIMS. Things you can configure on this tab include:
*
Understanding entity groups
*
How to auto-upgrade Observer
*
Running NIMS as a Windows service
*
Using a failover NIMS


User Groups

User Groups
User Groups
Understanding user groups
Users groups provide the mechanism for fine-tuning access permissions. Think of a user group as a security profile that lets you easily replicate the permissions appropriate for a particular class of users, rather than having to enter the permissions manually for each user.
If you want to grant the same user different access permission based on the probe being accessed, you must add the same user to different user groups (each user group with its own access permissions). You must also enable entity groups in the Management Server Options dialog.
For example, suppose you want Tony to have full access to the local probes in Minneapolis, but not allow him to capture packets on probes located in the central office in Palo Alto. You would create two entity groups (“MSP Probes” and “PA Probes”), and two user groups (“MSP Admins” and “Operators”) with permissions set appropriately.
By adding MSP Admins (who have full permissions) to the access list for MSP Probes, Tony is granted full access permission to any probe in the MSP entity group. By adding Operators to the access list for PA Probes, Tony will have more restricted access to the Palo Alto Probes.
Note: If you have no need for different users to have different access permissions, you have no need to create any user groups orentity groups, and you can disable this feature in the Options > Management Server Options > General tab.


How to create a user group

User Groups > Understanding user groups > How to create a user group
How to create a user group
1.
To create a user group, click the User Groups tab, then choose Edit > New User Group. The permissions are described Table 1.
After completing this task:
After creating a user group, add users to that group. See How to add users to a user group.
Table 5. User group permissions
Permission
Description
Probe Administrator
Modify Partial Packet Capture Size—User is granted the ability to change how much of a packet is saved during packet capture.
Packet Capture—User is granted the ability to capture, decode, analyze, and view raw packets captured from the probe.
Select network adapter—User is allowed to select the network adapter from which the probe is to capture data.
Configure
User is allowed to configure the probe (that is, set up instances, memory allocation, and so on).
Encrypt Data
User is granted the ability to encrypt any data (statistics, packet captures, and so on) when connected to the probe.
Data sent to the analyzer is Triple DES encrypted during transmission. By making Triple DES encryption passes, it increases the effective key length to 168 bits.
Only use this option if you need strong encryption, because it imposes a significant performance cost. Even with this option turned off, the probe does not send raw, easily-readable data; the data is concealed by a proprietary compression algorithm.
Internet Observer
User is granted the ability to run Internet Observer, which shows the URLs being accessed by stations on your network, among other analysis.
Modify protocol definitions
User is allowed to modify any shared protocol definitions, including definitions of what any derived applications in Observer are. Extra caution should be used with this setting because definitions are automatically propagated to all analyzers (assuming the setting is selected in Observer). If two users are updating the same protocol definition, the last user to save and close the window is whose definition will be used. Only one user (or a small select group of users) should be responsible for maintaining the list of protocol definitions. This ensures that no inadvertent changes are made.
Modify shared filters
User is allowed to modify any shared filters. User is allowed to modify shared filters. This feature must also be enabled on the probes.
Network Trending
User is allowed to view Network Trending reports. Network Trending is a mechanism for sampling and archiving network traffic over long periods of time.
Redirect
User is granted the ability to redirect the probe to connect with different Observer analyzers.
WAN Configuration
User is allowed to change WAN probe settings such as encapsulation type and Committed Information Rate (CIR), and to combine logical channels by combining multiple physical connections. Only applicable to Network Instruments WAN hardware probes.
Reconstruct data
User is allowed to reconstruct data and view the data in Reconstruct Stream or TCP Dump.
Replay VoIP audio
User is allowed to replay audio VoIP data.
Replay VoIP video
User is allowed to replay video VoIP data.
Transfer Capture Files from Probe
User is allowed to move capture files.
Log user activity
Tracks dozens of different actions that a user may do with a probe, such as start or stop it or starting or stopping any of the statistics that Observer collects.
Observer Infrastructure Access Level
User has the selected level of access to Observer Infrastructure.
None:
No access to Observer Infrastructure
Web Reports:
View web reports of allowed device groups in a web browser
Guest: Web Reports access, plus
Connect to allowed device groups
Power User: Guest access, plus
Connect to allowed device groups and view its status and properties
Edit allowed device groups
Start/stop polling
Administrator: Power User access, plus:
Create, delete device groups and routes
Observer Reporting Server
Web Reports: User has the permission to access reports through a web browser. The user has access to all reports available to the business group in ORS. When the ORS entity was created in NIMS, a business group was specified. If no business group was specified, then the user has access to all reports on the ORS system.


How to add users to a user group

User Groups > Understanding user groups > How to add users to a user group
How to add users to a user group
1.
To add a user to a user group, click the User Groups tab.
2.
Select the user group to which you want to add the user and choose Edit > Add/Remove Users.
3.
Select the user(s) and click OK.


How to delete a user group

User Groups > Understanding user groups > How to delete a user group
How to delete a user group
1.
To delete a user group, click the User Groups tab.
2.
Select the user group you want to delete and choose Edit > Delete User Group.


User Accounts

User Accounts
User Accounts
Managing user accounts
Because access permissions are attributes of a user group rather than a user, you must create a user group for each level of access you desire. For example, you might create an “Admin” user group that has all permissions enabled, and an “Operator” user group that has packet decode disabled. After these user groups have been added to the Undefined Probes Group, members of the Admin user group have full permission after being authenticated to any probe that requests it of the server. Members of the Operator group have access to any authenticated probe, but will not be able to view decoded packets.
If a particular user is a member of two user groups that belong to the same entity group’s access list, permissions are cumulative. For example, if Tony belongs to user groups “operator” (without packet capture privileges) and “Admin” (with packet capture privileges), and you add both of these user groups to an entity group, Tony will have permission to capture packets from both probes.
To give a group of users authenticated access to probes, you must follow these steps:
1.
If implementing entity groups (which are necessary for creating user permissions that are probe-dependent), create one or more entity groups and set their permissions.
2.
Create users (or import a user list from the local Windows system, or any Active Directory server).
3.
Assign each user to an entity group.


How to add new users

User Accounts > Managing user accounts > How to add new users
How to add new users
There are several ways to add users to NIMS. Choose the one that is best for you. Before adding a user, consider how you want the users to authenticate with NIMS.
From NIMS’ internal list
By default NIMS does not have any users in its internal list. You must add them.
1.
Click Options > Management Server Options > Authenticate.
2.
Select the “Management Server’s internal user list” option. Click OK.
3.
Click the User Groups tab and choose Edit > New User. The New User window opens.
4.
Type a user name, password, e-mail address (optional), and pick a user group. Do not worry if you have not yet created user groups. You can assign users to user groups later.
See How to add users to a user group.
From accounts on the NIMS system
NIMS can use the user accounts on the NIMS system itself to create a list of users.
1.
Click Options > Management Server Options > Authenticate.
2.
Select the “Management Server’s internal user list” option. Click OK. Repeat as necessary. Click OK and confirm the message about configuring the list of users.
3.
A list of all of the system’s users (or the group you selected) appears. Choose the users you want to add to NIMS. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.
From a RADIUS server
You can use your RADIUS server to authenticate users from NIMS, but you cannot import a list of users from your RADIUS server. You can, however, manually enter them or get a list of users from your domain server and then switch to authentication type.
1.
Click Options > Management Server Options > Authenticate. Skip to 9 if your RADIUS server uses different accounts or you want to manually add user accounts to NIMS.
2.
Select the “User accounts from the remote Domain Server” option and provide the host name or IP address of the domain server.
3.
Type a user name with access to the domain server list. This user does not need any special access. It must simply be a member of the domain.
4.
Provide the password for the user account.
5.
(Optional) Click the Get Groups button to fetch any groups from the domain server.
6.
If you know you want to limit what groups of users from your domain server appear in NIMS, you can set that group. You may only choose one group. Click OK and confirm the message about configuring the list of users.
7.
A list of all of the domain users (or the group you selected) appears. Choose the users you want to add to NIMS. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.
8.
Click OK to close the Management Server Options window and then reopen it.
9.
On the Authentication tab select the “RADIUS server” option.
10.
Click the Details button and complete the options with the necessary information. Click OKand confirm the message about configuring the list of users. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.
11.
(Optional) Within your RADIUS server you may need to add NIMS as a RADIUS client. See your RADIUS documentation for details.
From a TACACS+ server
You can use your TACACS+ server to authenticate users from NIMS, but you cannot import a list of users from your TACACS+ server. You can, however, manually enter them or get a list of users from your domain server and then switch to authentication type.
1.
Click Options > Management Server Options > Authenticate. Skip to 9 if your TACACS+ server uses different accounts or you want to manually add user accounts to NIMS.
2.
Select the “User accounts from the remote Domain Server” option and provide the host name or IP address of the domain server.
3.
Type a user name with access to the domain server list. This user does not need any special access. It must simply be a member of the domain.
4.
Provide the password for the user account.
5.
(Optional) Click the Get Groups button to fetch any groups from the domain server.
6.
If you know you want to limit what groups of users from your domain server appear in NIMS, you can set that group. You may only choose one group. Click OK and confirm the message about configuring the list of users.
7.
A list of all of the domain users (or the group you selected) appears. Choose the users you want to add to NIMS. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.
8.
Click OK to close the Management Server Options window and then reopen it.
9.
On the Authentication tab select the “TACACS+ server” option.
10.
Click the Details button and complete the options with the necessary information. Click OKand confirm the message about configuring the list of users. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.
11.
(Optional) Within your TACACS+ server you may need to add NIMS as a TACACS+ client. See your TACACS+ documentation for details.
From a domain server or Active Directory
1.
Click Options > Management Server Options > Authenticate.
2.
Select the “User accounts from the remote Domain Server” option and provide the host name or IP address of the domain server.
3.
Type a user name with access to the domain server list. This user does not need any special access. It must simply be a member of the domain.
4.
Provide the password for the user account.
5.
(Optional) Click the Get Groups button to fetch any groups from the domain server.
6.
If you know you want to limit what groups of users from your domain server appear in NIMS, you can set that group. You may only choose one group. Click OK and confirm the message about configuring the list of users.
7.
A list of all of the domain users (or the group you selected) appears. Choose the users you want to add to NIMS. If you miss some users that you want to add later, you can add them through Edit > Add/Remove User.


How to block a user

User Accounts > Managing user accounts > How to block a user
How to block a user
Rather than deleting a user from NIMS, you may wish to block him.
1.
To block a user, click the User Groups tab and select the user.
2.
Choose Edit > Block User.


How to delete a user

User Accounts > Managing user accounts > How to delete a user
How to delete a user
Deleting a user from NIMS is a simple task. If you get the user account from the NIMS internal list, the user is deleted from NIMS. If you get the user from the local system, domain, Active Directory, RADIUS, or TACACS+, the user is removed from NIMS, but remains untouched on the local system, and so on.
Tip! Instead of deleting the user, consider whether blocking the user is more appropriate for you. Some organizations require accounts for auditing purposes. See How to block a user.
1.
To delete a user, click the User Groups tab and select the user.
2.
Choose Edit > Delete User.


Entity Groups

Entity Groups
Entity Groups
Understanding entity groups
The Entity Groups tab lets you configure probes and entity groups. An entity is any Observer analyzer; Observer probe, including GigaStor; Observer Infrastructure system; or Observer Reporting Server system. To add an entity, you must know its IP address and give it a unique name. Entity groups can be used to categorize devices by any criteria that you desire (for example, physical location, users it serves, and so on).
The Entity Groups and Entity Group Access tabs are available only if you have enabled entity groups in the Options > Management Server Options dialog.
The Entity Group Access tab lets you create and manage entity groups, and set which user groups have access to each entity group. Probes can be grouped by location, function, or any other criteria you desire. In addition to letting you add user groups to entity groups, this tab also lets you add probes themselves, identified by a unique name and IP address.


How to create an entity group

Entity Groups > Understanding entity groups > How to create an entity group
How to create an entity group
To create entity groups, you must know the IP address of each member probe and type it manually from the Entity Groups tab. To add the same user to different user groups, you must enable this feature, which is done by choosing Options > Management Server Options > General and checking the appropriate option.
To create an entity group:
1.
Click the Entity Groups tab, then choose Edit > New Entity Group. The New Entity Group window opens.
2.
Type a name for the entity group and click OK.
3.
Select your new group. Right-click and choose Add User Group.
4.
Choose the user group you want to add. Repeat if you want to add multiple user groups to this entity group.


Adding a probe to an entity group

Entity Groups > Understanding entity groups > Adding a probe to an entity group
Adding a probe to an entity group
Adding a probe to an entity group allows you to put probes together that share some similar characteristics (location, type, purpose, and so on).
To add a probe to an entity group,
1.
Click the Entity Group Access tab and select the entity group to which you want to add a probe.
2.
Click Edit > New Entity. The New Probe window opens.
3.
Select the entity type (Observer, Observer Infrastructure. or Observer Reporting Server). Depending on what entity type you are adding, you have different decisions to make.
4.
For an Observer analyzer or probe, type a name and the probe’s IP address, then click OK. This adds the probe to the entity group. Repeat until you have added all of the probes you want to the group.
5.
For an Observer Infrastructure entity, type the name you want to give this entity in NIMS and its IP address. If the Device Group option is unchecked, then all devices are available to users who have access to this entity. To limit access, select Device Group and choose which device groups the user may access.
6.
For an Observer Reporting Server entity, type the name you want to give this entity in NIMS and its IP address. If the Business Group option is unchecked, then all reports are available to users who have access to this entity. To limit access to which reports a user may view, select Business Group and choose to which business group the user belongs.


Deleting an entity group

Entity Groups > Understanding entity groups > Deleting an entity group
Deleting an entity group
Deleting an entity group removes the group from NIMS, but does not remove any users. Deleting an entity group also means that any users who were members of that group will no longer have access to the Observer analyzers, probes, Observer Reporting Server, or Observer Infrastructure systems if that was the only group of which they were a member.
1.
Click the Entity Groups tab and select the entity group you want to delete.
2.
Click Edit > Delete Entity Group.


Adding or removing a user group to an entity group

Entity Groups > Understanding entity groups > Adding or removing a user group to an entity group
Adding or removing a user group to an entity group
Adding a user group (that is, a group of users with defined permissions) to an entity group gives all the users within that group access to all the probes within the entity group. Because permissions are defined by user group, and users may belong to different user groups simultaneously, you can give the same user different levels of permission depending on the user group through which they access the probe.
To add a user group to an entity group,
1.
Click the Entity Group Access tab and select the entity group to which you want to add a user group.
2.
Click Edit > Add User Group. The Add User Group Window opens.
3.
Select which user groups to which you want the entity group. If you have not defined any user groups, only the default group is listed. See How to create a user group.


Auto-upgrading NIMS' clients

Auto-upgrading NIMS' clients
Auto-upgrading NIMS' clients
How to auto-upgrade Observer
Just like you can have NIMS issue licenses automatically to probes and the Observer analyzers, you can use NIMS to auto-upgrade Observer analyzers and probes with any version release you choose. You can have NIMS update both analyzers and probes, or have it just update the analyzers, which will in turn update any probes (if configured).


Understanding the NIMS auto-upgrade process

Auto-upgrading NIMS' clients > How to auto-upgrade Observer > Understanding the NIMS auto-upgrade process
Understanding the NIMS auto-upgrade process
NIMS auto-upgrade automates the transfer and installation of probe software versions, such as when new releases must be deployed to remote sites. Careful planning is required to ensure successful transfer and installation.
NIMS contains a mechanism for automatically pushing probe upgrades to Observer analyzers and probes. This feature is known as auto-upgrade. NIMS auto-upgrade removes the need to distribute new versions of the probe software via outside channels like FTP and network shares. Plus, auto-upgrade provides unattended installation, so coordinating personnel to be present at the time and place of installation is now a choice—it is no longer a requirement. An otherwise difficult task is made easier with auto-upgrade.
Under what circumstances should I use auto-upgrade?
There are no steadfast requirements or conditions that must be met for auto-upgrade to prove beneficial.
However, there are scenarios where auto-upgrade proves especially useful. Here are a few examples:
*
You need to upgrade off-site Observer analyzers and probes that you have no direct access to.
*
You have many Observer analyzers and probes that need to be upgraded.
*
You want to transfer the installation files during non-peak network times.
*
You have limited uplink speeds, such as ISDN or 56K modems, and need to throttle the transfer speed.
*
You want to ensure the installation occurs during non-peak network times, like overnight.1
*
You want to resume the data transfer from the point of termination if the connection terminates unexpectedly.1
How does auto-upgrade operate?
Several options affect your use of auto-upgrade. Used together, these functions create a platform for version delivery and installation:
On-demand
Force a probe or Observer analyzer to update to a chosen software version.
Scheduled transfer
Create a scheduled window of time for upgrade data to be transferred for eventual installation.
Scheduled installation
Create a scheduled window of time for installation to occur.
If you want to keep things simple, you can just use auto-upgrade when necessary (on-demand), or simply leave the feature disabled—which is the default behavior in NIMS. If you have many Observer analyzers and probes, using scheduled transfer and scheduled installation is highly recommended.
How does the scheduled transfer operate?
Scheduling your upgrade transfer is an effective strategy for limiting the ill-effects of network resource consumption otherwise caused by an on-demand upgrade transfer. Because upgrade data is sent over the same link that the target Observer analyzers and probes use for other duties, it is recommended that upgrade transfers are only scheduled during opportune times. Understand that scheduling the upgrade transferdoes not define when the transfer should start or finish; you are simply defining the window of time NIMS can transfer upgrade data to Observer analyzers and probes. NIMS makes every attempt to send data during the scheduled transfer time, but you should schedule a large enough time frame for NIMS to facilitate the transfer.
If a transfer cannot successfully finish within the time frame you set, NIMS resumes the transfer—from where it was interrupted—during the next time frame available.1 For example, if you only set a one-hour transfer window for Tuesday each week, and the transfer did not complete during that hour, then the transfer is suspended until the following Tuesday for the chance to resume.
How does the scheduled installation operate?
When probe upgrades occur, the probe must be stopped from its monitoring duties during the upgrade installation and must ultimately reboot. These two events cause downtime. Therefore, by controlling the installation time, you can control when the downtime occurs. In this way, scheduling the upgrade installation is, essentially, scheduling the time frame an Observer analyzer or probe outage is acceptable. Understand that scheduling the upgrade installationdoes not define when the upgrade installation should start or finish; you are simply defining the window of time NIMS can initiate an upgrade installation of your Observer analyzers and probes.
If the probe software is running as a Windows service, you can choose to have the probe restart automatically. This is a configuration option in the probe’s settings and especially useful for remote probes where there is not a local administrator. See Configuring a probe’s name and other probe options.
If you choose to schedule your upgrades, NIMS still only initiates a scheduled installation if all of these statements are true:
1.
The target Observer analyzer or probe is version 16.1 or higher.
2.
The target Observer analyzer or probe requests a license, which is does upon startup; or NIMS sends an installation request to the Observer analyzer or probe, which occurs approximately every hour. The target cannot decline the request.
3.
The current time is within the installation time frame you scheduled.

1
These options are only available to Observer analyzers and probes already at or above version 16.1.


How to auto-upgrade all clients of NIMS

Auto-upgrading NIMS' clients > How to auto-upgrade Observer > How to auto-upgrade all clients of NIMS
How to auto-upgrade all clients of NIMS
Prerequisite(s):
Make sure that Observer analyzers and probes are licensed through NIMS, and that encryption key files have been generated and distributed. In analyzer Observer software, these options are located in Options > Observer General Options > Security. In probe software, these options are located in Options > Probe Options.
To use auto-upgrade to update Observer analyzers or probes managed by NIMS, follow these steps:
1.
In NIMS, choose Options > Import ObserverSetup.exe File To Use For Upgrades.
2.
Navigate to and select an installation executable. Click Open.
This executable is used by NIMS for pushing upgrades. You only need to perform this step once; the executable remains with NIMS. However, you must repeat this step if you want to change which executable is used for auto-upgrade, such as a newer version.
NIMS prepares the installation executable for deployment.
3.
Choose Options > Management Server Options > General tab from the NIMS main menu.
4.
In the Auto-upgrade Probes/Observers area, enable the auto-upgrade feature. Choose one setting that specifically affects if auto-upgrade is enabled or not:
*
Don't auto upgrade—Disabled
*
Autoupgrade only to a new major version—Enabled
*
Auto-upgrade to any new version (major, minor, or build)—Enabled
5.
(Optional) Enable or disable other settings that affect auto-upgrade:
Setting
Description
Do not auto-upgrade Advanced Multi-Probes
If enabled, auto-upgrade does not apply to Advanced Multi-Probes. Instead, Advanced Multi-Probes must rely on Observer analyzers for auto-upgrade.
Also allow to auto-downgrade to the current NIMS version
If enabled, Observer analyzers and probes running newer versions of the software than NIMS is distributing are automatically downgraded. This ensures consistent version use.
Limit concurrent upgrades to
If enabled, this setting limits the total number of simultaneous upgrades that can occur.
Limit transfer speed to (kbps)
If enabled, this setting throttles the speed of upgrade transfers to a custom value.
When using per-entity auto-upgrade, this value also serves as a global bandwidth cap that is divided equally between all simultaneous transfers.
6.
(Optional) Click Schedule Upgrade Transfer and create a time frame for upgrade data to be pushed by NIMS to clients. Click OK.
When probe upgrades occur, the probe must be stopped from its monitoring duties during the upgrade installation and must ultimately reboot. These two events cause downtime. Therefore, by controlling the installation time, you can control when the downtime occurs. In this way, scheduling the upgrade installation is, essentially, scheduling the time frame an Observer analyzer or probe outage is acceptable. Understand that scheduling the upgrade installationdoes not define when the upgrade installation should start or finish; you are simply defining the window of time NIMS can initiate an upgrade installation of your Observer analyzers and probes.
7.
(Optional) Click Schedule Upgrade Installation and create a time frame for complete transfers to install. Click OK.
Scheduling your upgrade transfer is an effective strategy for limiting the ill-effects of network resource consumption otherwise caused by an on-demand upgrade transfer. Because upgrade data is sent over the same link that the target Observer analyzers and probes use for other duties, it is recommended that upgrade transfers are only scheduled during opportune times. Understand that scheduling the upgrade transferdoes not define when the transfer should start or finish; you are simply defining the window of time NIMS can transfer upgrade data to Observer analyzers and probes. NIMS makes every attempt to send data during the scheduled transfer time, but you should schedule a large enough time frame for NIMS to facilitate the transfer.
Now, when an Observer analyzer or probe either obtains a license from NIMS or is specially contacted by NIMS (approximately every hour), NIMS checks to ensure that the client has the appropriate version and upgrades or downgrades if necessary.


How to auto-upgrade individual clients of NIMS

Auto-upgrading NIMS' clients > How to auto-upgrade Observer > How to auto-upgrade individual clients of NIMS
How to auto-upgrade individual clients of NIMS
Prerequisite(s):
Make sure that Observer analyzers and probes are licensed through NIMS, and that encryption key files have been generated and distributed. In analyzer Observer software, these options are located in Options > Observer General Options > Security. In probe software, these options are located in Options > Probe Options.
Note: The values you define in NIMS upgrade task per entity through NIMS upgrade task per entity take precedence over the values in Options > Management Server Options > General tab.
To use auto-upgrade to update an Observer analyzer or probe on a per-entity basis, follow these steps:
1.
In NIMS, choose Options > Import ObserverSetup.exe File To Use For Upgrades.
2.
Navigate to and select an installation executable. Click Open.
This executable is used by NIMS for pushing upgrades. You only need to perform this step once; the executable remains with NIMS. However, you must repeat this step if you want to change which executable is used for auto-upgrade, such as a newer version.
NIMS prepares the installation executable for deployment.
3.
Click the Entity Groups tab.
4.
Double-click an existing Observer analyzer or probe from the list of Entity Groups.
A new window appears, allowing you to change settings specific to that Observer analyzer or probe.
5.
In the Auto-upgrade Settings area, enable Allow to auto-upgrade.
6.
(Optional) Enable Limit upgrade transfer speed to (kbps) and set an appropriate value. This may not exceed the value of Limit upgrade transfer speed to (kbps) on the General tab. If it does, the value from the General tab is used.
7.
(Optional) Click Schedule Upgrade Transfer and create a time frame for upgrade data to be pushed by NIMS to clients. Click OK.
When probe upgrades occur, the probe must be stopped from its monitoring duties during the upgrade installation and must ultimately reboot. These two events cause downtime. Therefore, by controlling the installation time, you can control when the downtime occurs. In this way, scheduling the upgrade installation is, essentially, scheduling the time frame an Observer analyzer or probe outage is acceptable. Understand that scheduling the upgrade installationdoes not define when the upgrade installation should start or finish; you are simply defining the window of time NIMS can initiate an upgrade installation of your Observer analyzers and probes.
8.
(Optional) Click Schedule Upgrade Installation and create a time frame for complete transfers to install. Click OK.
Scheduling your upgrade transfer is an effective strategy for limiting the ill-effects of network resource consumption otherwise caused by an on-demand upgrade transfer. Because upgrade data is sent over the same link that the target Observer analyzers and probes use for other duties, it is recommended that upgrade transfers are only scheduled during opportune times. Understand that scheduling the upgrade transferdoes not define when the transfer should start or finish; you are simply defining the window of time NIMS can transfer upgrade data to Observer analyzers and probes. NIMS makes every attempt to send data during the scheduled transfer time, but you should schedule a large enough time frame for NIMS to facilitate the transfer.
9.
Click OK to save your changes.
Now, when an Observer analyzer or probe either obtains a license from NIMS or is specially contacted by NIMS (approximately every hour), NIMS checks to ensure that the client has the appropriate version and upgrades or downgrades if necessary.


Maintaining Licenses and Security

Maintaining Licenses and Security
Maintaining Licenses and Security
Managing probe and Observer licenses
NIMS’ central license management supersedes the security settings in the probe or Observer analyzer. Matching Observer Encryption Key (.oek) files are required in the installation directory of both the probe and analyzer for the connection between them to be allowed. This is not supported for Single Probes.
When adding a license to NIMS you have two choices. You may add a probe license or an Observer analyzer license. A probe license allows a probe to authenticate against NIMS while an Observer license allows an Observer analyzer to authenticate.
If you have numerous probe and Observer analyzer licenses to manage, you do not need to enter a unique license on each probe. Assume you have
*
8 Multi Probe licenses
*
20 Expert Probe licenses (remember an Expert Probe can also function as an analyzer)
*
4 Observer Suite licenses
On your NIMS system, enter or import all of the unique licenses for the Multi Probe, Expert Probe, and the Observer Suite. Then take one of your eight Multi Probe licenses and use it for all eight Multi Probes. You do not need to provide each Multi Probe with its own unique license when you first open it. The Multi Probe will connect to NIMS, NIMS will confirm that the license is valid, and then NIMS will issue the Multi Probe a unique license from the license pool The same process is true for the Expert Probes and all Observer analyzers.
Using this method is especially convenient if you are cloning probes from a hard drive image. You can embed the same generic valid license key on all probes that have the same level of licensing. NIMS will then grant each system that queries it a valid, unique license upon startup.
In addition to centrally managing licenses, you may want to automatically push out new versions of the probe or Observer analyzer software when it is available. See How to auto-upgrade Observer.


Adding a license

Maintaining Licenses and Security > Managing probe and Observer licenses > Adding a license
Adding a license
Tip! If you have many licenses to enter, you may want to consider creating a text file with all of the licenses and importing that. See Creating a NIMS license file.
Follow these steps to add a probe or Observer license:
1.
Click the Licenses tab.
2.
Right-click anywhere on the tab and choose Add License. The Enter License Information window opens.
3.
Choose your license type: Observer or probe. If you are licensing an Expert Probe, choose Observer because an Expert Probe may run as a probe or as an analyzer. For Multi Probe and Single Probe, choose Probe.
4.
The following information must be entered exactly as it appears on the license document, including uppercase or lowercase letters and spaces, you received from Network Instruments.
*
License name (might also be a department name)
*
Company
*
License number
Do you need to license the probes or Observer analyzers? See Licensing the probes or Observer analyzers


Importing a license

Maintaining Licenses and Security > Managing probe and Observer licenses > Importing a license
Importing a license
Follow these steps to add a probe or Observer license:
1.
Click the Licenses tab.
2.
Choose File > Import License.
3.
Locate the file and click Open.


Deleting a license

Maintaining Licenses and Security > Managing probe and Observer licenses > Deleting a license
Deleting a license
From time to time you may need to remove a probe or Observer analyzer from your network. You should also delete the license for it as well. If you need to change the license because the user to whom the license has been assigned no longer needs it, you might want to edit the license information rather than deleting it. To delete the license, click the Licenses tab, right-click and then choose Delete License.


Creating a NIMS license file

Maintaining Licenses and Security > Managing probe and Observer licenses > Creating a NIMS license file
Creating a NIMS license file
A NIMS license file (.lic) is a text file with a specific format that contains all of the probe, Advanced Probe, GigaStor, and Observer analyzer license numbers. If you have many licenses to add to NIMS, you may want to consider adding the details to a .lic file rather than using the user interface.
The format for the .lic file is:
Observer:
<version number><tab>"<user name string>"<tab>"<company string>"<tab><license>
Probe, Advanced Probe, or GigaStor:
<version number><tab><Identification number><tab><license>
After completing this task:
Save the text file with the extension .lic, then import the license file.


Licensing the probes or Observer analyzers

Maintaining Licenses and Security > Managing probe and Observer licenses > Licensing the probes or Observer analyzers
Licensing the probes or Observer analyzers
NIMS is designed to do centralized management of license numbers and updates. Usually, all you must do is to install the same probe license on every probe system (or analyzer license on every analyzer system). Then the probe or analyzer will obtain a valid license from NIMS.
If an Observer analyzer is configured to obtain its license from NIMS and you remove the license that it had previously it will just grab the next available license. If you want to prevent a user from using the analyzer, you should block the user.


Defining probe access permissions

Maintaining Licenses and Security > Defining probe access permissions
Defining probe access permissions
This section describes how users may access probes or probe instances. It does not describe how to add users and grant them rights.
When you configure access permissions, you have a few choices.
1.
Choose Options > Management Server Options > General tab.
2.
Select how you want probes to be accessed using the information in the table.
3.
Select “Allow users to be members of multiple user groups” if you want to have different access permissions for users. This option lets you easily activate different security profiles for a single user depending on which probe is being accessed.
Access granted…
Description
Per probe
A probe may have more than one probe instance. Access to all probe instances on the probe is granted or restricted. To achieve this, uncheck the “Configure access permissions per Probe Instance rather than per Probe.”
Per probe instance
Access to a probe instance is granted on a case-by-case basis. To achieve this, ensure the “Configure access permissions per Probe Instance rather than per Probe” is selected.
Per entity groups
Access is granted on a user’s entity group membership. For example, if you want the user “Administrator” to have full access to all probes, and other users to have full access only to a local probe (with limited access to others), you need to define entity groups. This option can be used alone or in conjunction with the per probe or per probe instance options. Checking the “Configure access to Probes by Probe groups” option enables the Entity Groups andEntity Groups Access tabs.


Configuring how user accounts should authenticate

Maintaining Licenses and Security > Configuring how user accounts should authenticate
Configuring how user accounts should authenticate
In non-NIMS authentication, each probe maintains its own user accounts, prompting users for locally-stored passwords and granting them access levels based on locally-stored permissions. At a site with dozens of probes, this can be an administrative headache.
Rather than maintaining separate user accounts on each probe, all probes on your network can query NIMS to authenticate users by their passwords. You can start with a manually-entered list of users, or automatically populate and update the list from the local Windows system, any Active Directory domain server, Cisco RADIUS server, or a TACACS+ server.
To choose an Authentication method, click Options > Management Server Options, then click the Authentication tab.
Regardless of how you authenticate users, if you desire group-level permissions, you must manually configure NIMS groups (in other words, user group and group membership attributes are not imported from the local Windows system, domain server, or RADIUS server).
Option
Description
Management Server’s internal user list
Requires you to create the list of users and passwords manually. See How to add new users.
User accounts from this system
Requires you to enter a valid user name and password for the local Windows system. When you exit the dialog, you are prompted to select which user accounts from the local Windows system to add to NIMS. Check the boxes for the users you want to add click OK. The selected users are then added to NIMS Users tab. Unlike with manually-entered NIMS users, you cannot edit user passwords through NIMS; make any changes through Windows Control Panel.See From accounts on the NIMS system.
RADIUS server(s)
Lets you define primary and secondary RADIUS servers, along with Accounting Servers for each RADIUS server. The Accounting Servers track login attempts and session lengths. Refer to the RADIUS server documentation for more details. Choosing RADIUS authentication requires you to enter the IP address of the RADIUS server, along with a “shared secret” that matches a secret on the RADIUS server. When you exit the dialog, you are prompted to select which user accounts from the remote RADIUS to add to NIMS. Check the boxes for the users you want to add and then click OK. See From a RADIUS server.
TACACS+ server(s)
Lets you define primary and secondary TACACS+ servers. Refer to the TACACS+ server documentation for more details. Choosing TACACS+ authentication requires you to enter IP address of the TACACS+ server, along with a “shared secret” that matches a secret on the TACACS+ server. When you exit the dialog, you are prompted to select which user accounts from the remote TACACS+ server to add to NIMS. Check the boxes for the users you want to add and then click OK. See From a TACACS+ server.
Authenticate using remote Domain Server’s user accounts
Requires you to enter a path to the remote Domain Server along with a user name and password that are valid for that server. When you exit the dialog, you are prompted to select which user accounts from the remote Domain Server to add to NIMS. Check the boxes for the users you want to add and then click OK. See From a domain server or Active Directory.


Understanding why NIMS may time out

Maintaining Licenses and Security > Configuring how user accounts should authenticate > Understanding why NIMS may time out
Understanding why NIMS may time out
If NIMS is timing out so that you cannot administer any clients or redirect any probes and you are positive that you are using the correct user name and password, then consider the following options.
*
Verify the user is not blocked. To unblock a user, click User Groups and select the user. Choose Edit > Unblock User .
*
Verify the user is a member of the proper user group.
*
Verify security settings in Observer, the probe, and NIMS.
*
Verify there are no authentication errors in the NIMS log file. If you see a log message that says "Failed to connect to NIMS on probe probe_name during redirection," that typically means the issue is with the probe and not NIMS. Ensure your probe is up, running, and reachable.


Setting failed login attempt limits and notifications

Maintaining Licenses and Security > Setting failed login attempt limits and notifications
Setting failed login attempt limits and notifications
1.
Click Options > Management Server Options > Security to configure failed login attempt limits and whether you should be notified about them. If you want a notification, you must provide an e-mail address or pager number.
The “Consecutive Failed Login Attempts” options allow you set how sensitive the Management Server should be towards failed login attempts. If a user exceeds the number of failed login attempts, the user is automatically blocked and must be manually reinstated.
The “Alarm Notifications” settings allow you choose the notification method for alarms: pager, e-mail, or both. E-mail and pager services are configured on the Notifications tab.


Configuring e-mail server and pager settings

Maintaining Licenses and Security > Configuring e-mail server and pager settings
Configuring e-mail server and pager settings
The Management Server’s Notifications settings are exactly those of the Observer analyzer and probes. On the Notifications tab, you can choose whether you have an e-mail or page sent to you when a warning occurs.
This section describes how to use the Options > Management Server Options > Notifications tab to configure the e-mail server and pager so that warning messages can be sent.


Configuring the e-mail server

Maintaining Licenses and Security > Configuring e-mail server and pager settings > Configuring the e-mail server
Configuring the e-mail server
This section describes how to configure NIMS to work with your e-mail server to send messages.
1.
Choose Options > Management Server Options > Notifications.
2.
In the E-mail Settings section, provide either a host name or IP address of your mail server.
3.
If your mail server uses a port other than 25, type it in the SMTP Port box.
4.
Type the address which will be used to send NIMS messages.
5.
By default the e-mail will appear to be from “NIMS.” If you want the name that appears in your e-mail client to display a different name, type it in the Display as box.
6.
Choose the type of authentication your mail server requires. The choices are:
*
None—No authentication required.
*
CRAM-MD5—The E-mail server requires that clients conform to the Challenge-Response Authentication Mechanism described in RFC 2195.
*
Login—The E-mail server requires encrypted user name and password login.
*
Plain—The E-mail server requires plain text user name and password login.
7.
Type the user name and password of the account used to send NIMS message logs. The fields are unavailable if you have selected an Authentication of none.


Configuring the pager

Maintaining Licenses and Security > Configuring e-mail server and pager settings > Configuring the pager
Configuring the pager
Youmay have to modify some settings to adapt to the local environment. It will be necessary to choose among the provided services or install a new paging service and substitute the local pager access number, if any, for the supplied one.
Note: When NIMS starts, it also starts a separate Windows process called Network Instruments Paging Service, which you can find in the system tray. After configuring the pager, verify the settings for the paging service match your needs.
1.
Choose Tools > Program Options > Notifications tab.
2.
In the Phone Pager Settings section, select the pager service from the menu. If your pager is not on the list, click on the New button and complete the details on the Paging Service Properties dialog to add yours.
3.
To view the initial pager configuration dialog, click the Properties button. The Paging Service Properties dialog appears.
4.
Type the Service name. This is the name of the service used to access the pager. The Service name you selected from the list is your default.
5.
Type the Service phone number—use the international number format (for example, +1 (123) 1234567) to allow TAPI to work with the Windows location settings.
This option does not appear if you are using an SNPP pager service, because SNPP uses TCP/IP to communicate with the paging service rather than a modem.
If it is necessary to have NIMS wait for an outside line, insert one or more commas at the beginning of the string (for example, ,,,+1 (123) 123-4567).
Additional spaces and the hyphen in the phone number are optional. They make the number more easily readable by the user, but are ignored when dialing. NIMS only dials the numbers and pauses for approximately one-half second for each comma character.
6.
Select a Service protocol from the list. NIMS supports four different pager service protocols: TAP, UCP, SNPP, and Voice. Selecting the appropriate service protocol and clicking the Configure button allows you to enter service-specific configuration data. Each protocol displays a different set of options that must be set.
7.
Type the maximum message length for the pager and click OK.


Configuring the paging service

Maintaining Licenses and Security > Configuring e-mail server and pager settings > Configuring the paging service
Configuring the paging service
1.
Choose Options > Management Server Options> Notifications to display the pager settings and change them. You may have to modify some settings for your location and paging service. Choose among the provided services or install a new paging service and substitute the local pager access number, if any, for the supplied one.
2.
Select the Default pager configuration from the menu.
If your pager is not on the list, click the New button. The Paging Service Properties dialog will be displayed.
3.
To view the initial pager configuration dialog, click the Properties button. The Paging Service Properties dialog will be displayed.
4.
Enter the Service name. This is the name of the service used to access the pager; the Service name you selected from the list is your default.
5.
Enter the Service phone number—use the international number format (for example, +1 (123) 1234567) in order to allow TAPI to work with the Windows location settings.
This option will not be displayed if you are using a SNPP pager service, as SNPP uses TCP/IP to communicate with the paging service, rather than a modem.
If it is necessary to wait for an outside line, insert one or more commas at the beginning of the string (for example, ,,,+1 (123) 123-4567).
Additional spaces and the hyphen in the phone number are optional; they make the number more easily readable by you, but will be ignored when dialing: NIMS will dial only the numbers and pause for approximately one-half second for each comma character.
6.
Select a Service protocol from the list. NIMS supports four different pager service protocols: TAP, UCP, SNPP, and Voice. Selecting the appropriate service protocol and clicking the Configure button enables you to enter service-specific configuration data. Each protocol displays a different set of options that need to be set. Those options are described below for each protocol.
7.
Enter the maximum message length for the pager.
8.
Click the OK button.
9.
Check the Apply advanced pager settings and click the Advanced button to display the Phone Pager Schedule dialog.
10.
Check the desired scheduling option. You can add or edit start times by using the buttons at the bottom of the dialog.


Pager Service Tray Icon

Maintaining Licenses and Security > Configuring e-mail server and pager settings > Pager Service Tray Icon
Pager Service Tray Icon
When NIMS is launched, the Network Instruments Paging Server icon is displayed in the Windows tray. You can right-click the icon to display a menu or you can double-click the icon to display the About Network Instruments Paging Server dialog.
The Paging Server Setting dialog contains the following items.
Wait for service connection (seconds)
allows you to set the time for a service connection.
Retry delay (seconds)
allows you to set the interval between attempts to send a pager message.
Number of retries
allows you to set the number of times to retry sending a failed pager message. When the pager message is successfully sent, further retries are aborted.
Discard messages older than (minutes)
allows you to set the number of minutes to attempt to keep sending a paging message. After this time period, if minutes are reached, the message, even if not sent, is discarded.
Days to keep pager logs
allows you to set the number of days to keep pager logs. Log entries older than this are purged.
Configure Paging Service
allows you to configure your paging service.
The primary use of Send Page is to enable you to test the paging service without creating an error event to trigger a page. It also can be used simply as a convenient way to send a pager message from the Windows desktop.


Using NIMS Event Log

Maintaining Licenses and Security > Using NIMS Event Log
Using NIMS Event Log
1.
You can see what events have been logged by NIMS by clicking the Events Log tab. You can define how often messages should be saved to disk, and how long to keep data before overwriting the log file by clicking Options > Management Server Options > Event Log. Items written to the log include:
*
Successful login attempts along with the user’s permission level, what probe was authenticated, and so on.
*
Failed login attempts. Failed login attempts have additional information, such as bad user name/password, user locked out, unable to contact RADIUS/TACACS+/Active Directory.
*
Failed shared key loading.
*
All license requests and what licenses are provided, and to which IP the license was sent.
*
When a user synchronizes shared filters, along with what filters were added or modified.
*
When a synchronization occurs between primary/secondary server.


How to integrate an HSM for SSL private key decryption

Maintaining Licenses and Security > How to integrate an HSM for SSL private key decryption
How to integrate an HSM for SSL private key decryption
NIMS can interact with a compatible hardware security module (HSM) to request temporary SSL private keys for network traffic decryption.
Prerequisite(s):
NIMS must be a client of your HSM platform; therefore, the HSM client technology must be installed on NIMS.Consult your HSM vendor’s documentation for setup and configuration instructions before continuing.
By enabling HSM decryption options in NIMS, NIMS can request a temporary decryption key from your compatible hardware security module. The temporary decryption key can then be used by authorized probes and Observer analyzers for decrypting encrypted network traffic—but only on the specific conversation you want to decrypt. This process is currently the only way NIMS uses HSM functionality.
To use a hardware security module (HSM) to provide decryption key access to authorized users or systems, complete the following steps:
NIMS can only interface with HSM platforms that support PKCS #11, a public-key cryptography standard from RSA Laboratories.
1.
In NIMS, choose Options > Management Server Options.
2.
Click the HSM Decryption tab.
3.
Choose how configuration data is stored:
a.
Store configuration locally—configuration data is stored locally in NIMS.
b.
Store configuration in HSM token—configuration is stored in a token on the HSM.
In both cases, decryption requests are serviced identically; that is, requests are passed to the HSM and the HSM provides a temporary decryption key.
4.
Provide the full file path of the Cryptoki DLL installed on the NIMS appliance.
5.
If you chose to store configuration data in an HSM token, select the configuration token. Then, type the token user PIN associated with it.
6.
(Optional) Decide if the configuration token user PIN should be saved. This is essentially “remember my password.”
If the token user PIN is not saved (the default behavior; box unchecked), users must manually type the PIN each time the NIMS application is launched.
7.
Click Apply.
8.
If successful, the Tokens area is now accessible. You can:
*
Add a new token.
*
Edit an existing token.
*
Delete an existing token.
9.
Also if successful, the Private Keys area is now accessible. You can:
*
Add a new private key by choosing the Token and Key .
*
Edit the details of an existing private key.
*
Delete a NIMS reference to an existing private key.
*
Optionally restrict access to a key to only selected NIMS user groups.
After completing this task:
For more detail regarding these options, see Hardware security module (HSM) options.


Understanding the purpose of HSM with NIMS

Maintaining Licenses and Security > How to integrate an HSM for SSL private key decryption > Understanding the purpose of HSM with NIMS
Understanding the purpose of HSM with NIMS
Having NIMS integrate with a hardware security module (HSM) serves a clear purpose: it allows NIMS to access the content stored in the HSM to aid network traffic decryption.
NIMS replaces individual probe administration tasks with a centralized repository of authentication information. Rather than maintaining separate user accounts on each probe, all probes query NIMS to authenticate users. Not only does this ease administration, but it also helps you customize access levels.
Using an HSM with NIMS also furthers your goal of centralized and secure management. Specifically, having your HSM provide access to temporary decryption keys ensures these key benefits:
*
HSM-authorized systems managed by NIMS are provided access to temporary decryption keys only at the time they are needed.
*
Administrators are never given direct access to SSL private keys, so the keys cannot be lost or stolen.
*
Use of HSM-delivered temporary decryption keys is tracked. Both NIMS and the Observer analyzer log HSM events by default.


Hardware security module (HSM) options

Maintaining Licenses and Security > How to integrate an HSM for SSL private key decryption > Hardware security module (HSM) options
Hardware security module (HSM) options
NIMS is configurable to operate with any hardware security module (HSM) that supports PKCS #11, a public-key cryptography standard from RSA Laboratories.
Specifically, PKCS #11 uses a software API called Cryptoki (pronounced crypto-key) to facilitate many cryptographic functions in a secure and centralized manner. Complete information about RSA Security Inc. Public-Key Cryptography Standards (PKCS) #11 is available from RSA Laboratories.
By enabling HSM decryption options in NIMS, NIMS can request a temporary decryption key from your compatible hardware security module. The temporary decryption key can then be used by authorized probes and Observer analyzers for decrypting encrypted network traffic—but only on the specific conversation you want to decrypt. This process is currently the only way NIMS uses HSM functionality.
Options and descriptions for the HSM Decryption tab
The following window can be accessed, in NIMS, from Options > Management Server Options > HSM Decryption tab.
Option
Description
Serve Hardware Security Module Decryption Requests
Disabled
If selected, HSM decryption is completely disabled. Probes and Observer analyzers managed by NIMS are prohibited from using HSM facilitated SSL private key retrieval for traffic decryption.
Store configuration locally
If selected, HSM configuration data is stored locally on the NIMS appliance. This saves valuable storage space on the HSM (by not utilizing said storage) and can make administration of HSM tokens easier in the future. Although secured in hashed data, this option is less secure than storing the configuration directly in an HSM token.
Store configuration in HSM token
If selected, HSM configuration data is stored directly in the HSM configuration token. This consumes valuable storage space in the HSM and may make administration of HSM tokens more difficult in the future. If security is of the highest concern, then choose this option.
Hardware Security Module Configuration
PKCS #11 Cryptoki DLL
This is the file path to the currently specified Cryptoki DLL. If found blank—and HSM decryption is desired—this DLL location must be specified. The DLL can be found in the installation directory of the HSM client technology you must have installed on the NIMS system. Only after the Cryptoki DLL is specified can NIMS interface with the HSM.
Configuration Token on HSM
Configuration token
Only applicable when storing the configuration as a token on the HSM. A list of tokens on the HSM is shown in this field; you must select the token that configuration data is, or will be, stored in.
Token user PIN
The PIN that allows access to the configuration token. Different HSM vendors have different requirements for the PIN such as length and characters. Consult your HSM documentation for additional information.
Save configuration token user PIN
If enabled, the token user PIN does not need to be manually typed each time the NIMS application is launched. Enabling this option can make automation easier because a person is not required for system reboots, as one example. However, if security is of the highest concern, leave this option disabled.
Tokens
Token
A token that exists on the HSM and is being configured for access within NIMS.
Slot
The slot associated with the token.
Description
The description associated with the token.
Private Keys
Name
Name is an especially important field. Name is a text string that authorized probes and Observer analyzers managed by NIMS must provide to the SSL decryption dialog to invoke a decryption session on a network conversation. In other words, a name represents the SSL private key associated with it, so it must be provided at the time of decryption.
Token
The token which the private key is associated with.
Label
The label is the key name according to the HSM.


Recent documentation changes

Recent documentation changes
Recent documentation changes
Recent documentation changes
In addition to fixing typographical and grammar errors, these changes were also made to the documentation:
April 19, 2013 NIMS
*
Added technical specifications of the NIMS appliance. See NIMS technical specifications.
*
Added a new topic that explains why NIMS may time out and what troubleshoot. See Understanding why NIMS may time out.
*
Added a detail that if a user exceeds the number of failed login attempts, the user is automatically blocked and must be manually reinstated. See Setting failed login attempt limits and notifications.
February 12, 2013 NIMS
*
Added details about NIMS auto-upgrade enhancements.
*
Corrected port numbers used by NIMS. See Ports used by products.
December 18, 2012 NIMS
*
Added how to integrate NIMS with a hardware security module (HSM). NIMS to access the content stored in the HSM to aid network traffic decryption. See Understanding the purpose of HSM with NIMS.


Recent product changes

Recent product changes
Recent product changes
What's new or changed in NIMS version 16.1
*
Added robust version control for Observer analyzers and probes. See Understanding NIMS Auto-Upgrade.
*
Added several large enhancements for hardware security module (HSM) support.
What's new or changed in NIMS version 16
*
Added native 64-bit support. The installation wizard automatically chooses a 32-bit or 64-bit install based on system compatibility.
*
Added full IPv6 support.
*
Added ability to use a SafeNet HSM card for providing SSL private keys to Network Instruments products for packet capture decryption.


End User License Agreement

End User License Agreement
End User License Agreement
PLEASE READ THIS SOFTWARE LICENSE AGREEMENT CAREFULLY BEFORE DOWNLOADING OR USING THE SOFTWARE.
BY CLICKING ON THE “ACCEPT” BUTTON, OPENING THE PACKAGE, DOWNLOADING THE PRODUCT, OR USING THE EQUIPMENT THAT CONTAINS THIS PRODUCT, YOU ARE CONSENTING TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, CLICK THE “DO NOT ACCEPT” BUTTON AND THE INSTALLATION PROCESS WILL NOT CONTINUE, RETURN THE PRODUCT TO THE PLACE OF PURCHASE FOR A FULL REFUND, OR DO NOT DOWNLOAD THE PRODUCT.
The SOFTWARE is neither shareware nor freeware. The SOFTWARE is a commercial software package that is subject to international copyright laws.
Single User License Grant: Network Instruments, LLC (“DEVELOPER”) and its suppliers grant to END-USER a nonexclusive and nontransferable license to use the DEVELOPER software (“SOFTWARE”) in object code form solely on a single central processing unit owned or leased by END-USER or otherwise embedded in equipment provided by DEVELOPER.
Multiple-Users License Grant: DEVELOPER and its suppliers grant to END-USER a nonexclusive and nontransferable license to use the DEVELOPER SOFTWARE in object code form: (i) installed in a single location on a hard disk or other storage device of up to the number of computers owned or leased by END-USER for which END-USER has paid individual license fees purchased; or (ii) provided the SOFTWARE is configured for network use, installed on a single file server for use on a single local area network for either (but not both) of the following purposes: (a) permanent installation onto a hard disk or other storage device of up to the number of individual license fees purchased; or (b) use of the SOFTWARE over such network, provided the number of computers connected to the server does not exceed the individual license fees purchased. END-USER may only use the programs contained in the SOFTWARE (i) for which END-USER has paid a license fee (or in the case of an evaluation copy, those programs END-USER is authorized to evaluate) and (ii) for which END-USER has received a product authorization keys (“PAK”). END-USER grants to DEVELOPER or its independent accountants the right to examine its books, records and accounts during END-USER's normal business hours to verify compliance with the above provisions. In the event such audit discloses that the Permitted Number of Computers is exceeded, END-USER shall promptly pay to DEVELOPER the appropriate licensee fee for the additional computers or users. At DEVELOPER's option, DEVELOPER may terminate this license for failure to pay the required license fee.
END-USER may make one (1) archival copy of the SOFTWARE provided END-USER affixes to such copy all copyright, confidentiality, and proprietary notices that appear on the original.
EXCEPT AS EXPRESSLY AUTHORIZED ABOVE, END-USER SHALL NOT: COPY, IN WHOLE OR IN PART, SOFTWARE OR DOCUMENTATION; MODIFY THE SOFTWARE; REVERSE COMPILE OR REVERSE ASSEMBLE ALL OR ANY PORTION OF THE SOFTWARE; OR RENT, LEASE, DISTRIBUTE, SELL, OR CREATE DERIVATIVE WORKS OF THE SOFTWARE.
END-USER agrees that aspects of the licensed materials, including the specific design and structure of individual programs, constitute trade secrets and/or copyrighted material of DEVELOPER. END-USER agrees not to disclose, provide, or otherwise make available such trade secrets or copyrighted material in any form to any third party without the prior written consent of DEVELOPER. END-USER agrees to implement reasonable security measures to protect such trade secrets and copyrighted material. Title to SOFTWARE and documentation shall remain solely with DEVELOPER.
SOFTWARE, including technical data, is subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations, and may be subject to export or import regulations in other countries. END-USER agrees to comply strictly with all such regulations and acknowledges that it has the responsibility to obtain licenses to export, re-export, or import SOFTWARE.
This License shall be governed by and construed in accordance with the laws of the State of Minnesota, United States of America, as if performed wholly within the state and without giving effect to the principles of conflict of law. If any portion hereof is found to be void or unenforceable, the remaining provisions of this License shall remain in full force and effect. This License constitutes the entire License between the parties with respect to the use of the SOFTWARE.
Restricted Rights - DEVELOPER's software is provided to non-DOD agencies with RESTRICTED RIGHTS and its supporting documentation is provided with LIMITED RIGHTS. Use, duplication, or disclosure by the Government is subject to the restrictions as set forth in subparagraph “C” of the Commercial Computer SOFTWARE - Restricted Rights clause at FAR 52.227-19. In the event the sale is to a DOD agency, the government's rights in software, supporting documentation, and technical data are governed by the restrictions in the Technical Data Commercial Items clause at DFARS 252.227-7015 and DFARS 227.7202. Manufacturer is Network Instruments, 10701 Red Circle Drive, Minnetonka, MN 55343, USA.