During a recent attempt at gathering knowledge to assist in troubleshooting (see this post), I wanted to view the local ARP cache on a sensor. Although it would appear to have the information, it doesnt appear to want to give me it. From the CLI guide (we are running version 7.5):
"Dumps the contents of the current MAC/IP address mapping table in the database to a debug file. This command is used for debugging purposes. Use with the logstat (on page 56) command to provide a diagnostic trace to supply to Technical Support."
"Logs certain internal statistics of the Sensor which you can supply to Technical Support using the Manager's Diagnostics Trace feature. This command is used only for troubleshooting purposes in conjunction with the Technical Support."
Diagnostics trace creates an encrypted zip that then needs to be passed to McAfee. As far as I can see, there is no way of displaying what should be a reasonably simple thing to display. I am hoping I am incorrect - can anybody shed some light on either a)how to achieve this or b)the logic that led to customers not being able to troubleshoot...