QRadar: Networking troubleshooting of interfaces and connections using the command line

A QRadar appliance has four or more LAN connections. QRadar interfaces start with an en (Ethernet) designation, which is used with the management and monitor interfaces. Since QRadar uses interfaces for docker and other internal functions in this example, we are adding the grep command to isolate the en interfaces.

Test 1: Verify the network interface configuration

1. Use SSH to log in to the QRadar appliance as the root user.
2. To verify the state of the network interface, type: ip address show  | grep en
   For example,

   [root@qradar74 ~]# ip address show | grep en
   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
   2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
       inet 192.168.1.68/24 brd 192.168.1.255 scope global ens3
   3: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
       inet6 2001:db8:4::1/80 scope global tentative
       inet6 fe80::1/64 scope link tentative
   
   

   Note: en refers to ethernet, wl is for a wireless LAN adapter, and ww is for wireless wide area network.
3. Review the output to determine whether any settings appear to be incorrect:

• Verify the IP addresses are configured with the expected value for the appliance.
• Verify the transmission speed settings. Gigabit interfaces are expected to be configuration as qlen 1000.
• The interface is UP, indicating the interface is active.
• The MTU is configured to 1500.

Test 2: Review the transmission statistics for the interface

1. Use SSH to log in to the QRadar appliance as the root user.
2. To view interface statistics, type: ip -s a s <interface>
   For example,

   [root@qradar74 ~]# ip -s a s ens3
   2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc prio state UP group default qlen 1000
       link/ether 52:54:00:1c:1c:34 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.68/24 brd 192.168.1.255 scope global ens3
          valid_lft forever preferred_lft forever
       inet6 fe80::5054:ff:fe1c:1c34/64 scope link
          valid_lft forever preferred_lft forever
       RX: bytes  packets  errors  dropped overrun mcast
       80135      1120     0       0       0       0
       TX: bytes  packets  errors  dropped carrier collsns
       62641      537      0       0       0       0

3. Review the output for errors, dropped packets, or interface collisions.
    

The ethtool command retrieves the status of the Ethernet interface. Settings to take note of are Speed, Duplex, Auto-negotiate, and Link detected. The first three if not set correctly it might adversely affect performance of the appliance. The Link detected informs you whether the LAN interface is connecting to another device such as a switch or router. If the Link detected is down, it might be an indication that the LAN Cable or LAN interface is bad.

Procedure

1. Use SSH to log in to the QRadar appliance as the root user.
2. Type: ethtool <interface>
   For example,
   

If Duplex is set to half, that would mean the interface either transmits or receives packets, but not at the same time. Full Duplex is preferred due to simultaneous transmission and receipt of packets. Auto-negotiate determines the best state for Duplex and the speed of the interface. If there are issues with your switches, routers, or network manually changing these settings might be required.

1. Use an SSH session to log in to the appliance you need to test.
2. Type the ethtool command:  ethtool -S <interface>
   

The netstat command is helpful for determining port information. On a QRadar appliance, you might see a warning that you cannot connect to port 32006. Use the netstat command to test whether the port is open or blocked by a firewall rule, and is listening.

1. Use an SSH session to log in to the appliance you need to test.
2. Type the command: netstat -nap | grep :<port>
   For example,
   
3. Verify the port displays LISTEN, ESTABLISHED, or TIME_WAIT.

Results
In this example, the port is not blocked and is listening.

For more information on the netstat command, see Searching for ports in use by QRadar.

The traceroute command is useful in troubleshooting network problems, since the packets you send have to go through various networks and routers to reach their destination. If there is an issue with a busy network, it can also show the path with the highest traffic or where a network connection fails. In a local network, traceroute can give insight to whether a router is malfunctioning or if connectivity problems exist between hosts.

To use traceroute.

1. Use an SSH session to log in to the appliance you need to test.
2. Type the command: traceroute <destination IP address>
   Example of a successful connection with low latency:
   
   
   Example of unsuccessful connection with high latency:
   
   Note: Since traceroute uses ICMP, which is often blocked, instead try tracepath, which uses tcp socket link TCP port 22
   Example,