Trend Micro TippingPoint
TM

TM

Security Management System (SMS)
Command Line Interface ReferenceTrend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com/en-us/tippingpoint/security-managementsystem.aspx
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2024. Trend Micro Incorporated. All rights reserved.
Document Part No.: TPEM69845/230927
Release Date: January 2024
Protected by U.S. Patent No.: PendingThis documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that TippingPoint Security
Management System collects and provides detailed instructions on how todisable the specific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: SMS Command Line Interface Reference
Using the Command Line Interface (CLI) ............................. 1-2
Usage ........................................................................... 1-2
Command types ..................................................... 1-3
Set all system information using interactive mode........................................................................ 1-4
Remote paths ......................................................... 1-5
FTP .................................................................. 1-5
HTTPS ............................................................. 1-5
NFS .................................................................. 1-6
SMB (Samba) .................................................... 1-6
The help command ....................................................... 1-6
SMS command reference .................................................... 1-8
clear ............................................................................ 1-8
cls ................................................................................ 1-8
console ........................................................................ 1-9
date ............................................................................. 1-9
delete ........................................................................... 1-9
diags .......................................................................... 1-10
dir .............................................................................. 1-10
dns ............................................................................. 1-10
exit ............................................................................ 1-11
factoryreset ................................................................ 1-11
fips-mode ................................................................... 1-12
get ............................................................................. 1-12
help ........................................................................... 1-12
ifconfig ....................................................................... 1-13
ipconfig ...................................................................... 1-13
kbdcfg ........................................................................ 1-14
list ............................................................................. 1-14
mgmtsettings .............................................................. 1-15
monitor ...................................................................... 1-15
iSMS Command Line Interface Reference

more .......................................................................... 1-16
nic ............................................................................. 1-16
nicsettings .................................................................. 1-16
notify ......................................................................... 1-17
ntp ............................................................................. 1-17
ntp-auth ..................................................................... 1-18
password .................................................................... 1-18
ping ........................................................................... 1-19
proxy-config ............................................................... 1-20
quit ............................................................................ 1-21
radius ......................................................................... 1-21
reboot ........................................................................ 1-21
resolve ....................................................................... 1-22
restart ........................................................................ 1-22
reverse ....................................................................... 1-22
routes ......................................................................... 1-23
scp ............................................................................. 1-23
service-access ............................................................. 1-24
set .............................................................................. 1-25
setup .......................................................................... 1-25
shutdown ................................................................... 1-26
snmp .......................................................................... 1-26
snmp-request ............................................................. 1-26
snmp-trap .................................................................. 1-27
snmpget ..................................................................... 1-29
snmpwalk ................................................................... 1-29
ssh ............................................................................. 1-30
tacacs ......................................................................... 1-30
time ........................................................................... 1-30
touch .......................................................................... 1-31
traceroute ................................................................... 1-31
update ........................................................................ 1-33
users .......................................................................... 1-34
version ....................................................................... 1-34
vi ............................................................................... 1-35
view ........................................................................... 1-36
web ............................................................................ 1-37
ii

Table of Contents

who ............................................................................ 1-37
SMS attributes and objects ................................................. 1-37
Attribute types ............................................................ 1-38
cac ....................................................................... 1-38
cli ........................................................................ 1-39
ctl ........................................................................ 1-39
db ........................................................................ 1-42
dns ....................................................................... 1-44
high availability .................................................... 1-45
health .................................................................. 1-47
kbd ...................................................................... 1-51
logs ...................................................................... 1-54
net ....................................................................... 1-55
ntp ....................................................................... 1-60
pkg ...................................................................... 1-66
pwd ...................................................................... 1-68
radius ................................................................... 1-70
route .................................................................... 1-72
route6 .................................................................. 1-73
smtp .................................................................... 1-74
snmp .................................................................... 1-75
svc ....................................................................... 1-82
sw ........................................................................ 1-86
sys ....................................................................... 1-86
tacacs+ ................................................................. 1-87
time ..................................................................... 1-90

iii

iv

Chapter 1

CLI Reference
The following sections help you get started with the CLI Reference:
Using the Command Line Interface (CLI) on page 1-2
SMS command reference on page 1-8
SMS attributes and objects on page 1-37

1-1

SMS Command Line Interface Reference

Using the Command Line Interface (CLI)
The command line interface (CLI) can be used to configure many aspects of
the Trend Micro™ TippingPoint™ SMS. It includes wizards, high levelcommands, and low level commands.
Note
To use the SMS CLI, you must be logged in with an account that has SuperUser
rights or the Access SMS CLI capability enabled (on the SMS, go to Admin >Authentication and Authorization > Roles > Capabilities > Admin).

This section includes:• The general format of the CLI commands.
• Detailed information about commands, objects, and attributes.

Usage
Most SMS commands consist of the following elements:
command — the name of the command you want to issue
object — the name of a collection of related attributes (attribs)
attrib — the name of a data variable or parameter on which you want to run
the command[=value] — optional syntax you can use with the set command and otherwritable commands to define the value of the attrib you specify. If you do not
use this syntax, the system goes into interactive mode and prompts you forthe value. See Command types on page 1-3 for more information about
interactive commands.
Note
To clear the value of any attribute type a period (.) after the equal sign (=) or
when prompted.

1-2

SMS Command Line Interface Reference

These elements are case-sensitive. You can use any of the following syntax torun an SMS command:commandcommand objectcommand object.attrib
command object.attrib=value

Other SMS commands use a syntax similar to standard UNIX commands, as
shown in the following example:
command -option value

Command types
SMS commands are either read, write, or read and write. In addition,commands are either interactive, non-interactive, or might support both
options.
• Interactive commands — automatically prompt you for attribute values
if you use the appropriate syntax. Interactive commands also provide
you with the current values of their attributes.
• Non-interactive commands — are either read-only or require you to
specify the values you want to set. For example, the get command is
non-interactive because it is read-only. As another example, the datecommand is non-interactive. If you want to set the date, you must typedate value.
Interactive mode syntax
You can use any of the following syntax options to initiate an interactive CLI
command:command — If you type the command name, the CLI prompts you to set values
for all attribs associated with that command.
command object — If you specify the object of a particular command, the

CLI prompts you to set values for all attribs associated with that object.

1-3

SMS Command Line Interface Reference

command object.attrib — If you specify an object and attribute of aparticular command, the CLI prompts you to set the value of the attributeyou specified.

To see an example of how to use the set command, see Set all system
information using interactive mode on page 1-4.

Set all system information using interactive mode
Following is an example of the set command in interactive mode. Items inbold are typed by the user. Items in brackets ([ ]) indicate the current valueof the attribute specified.
Procedure
1.

Type the following command: set sys
The system returns prompts for information. Default values are listed inbrackets. To use the default value, press Enter.

2.

The system prompts you to set the value for the contact attribute:
System contact (sys.contact=[Customer Contact]) = Brit

3.

Type a value for the location attribute and press Enter: System

4.

Type a value for the name attribute and press Enter: System name(sys.name=[sms25]) =5.

The system returns the following confirmation message:

location (sys.location=[First floor lab]) =Result: Success6.

To see a summary of what you set, type get sys:
System contact(sys.contact ) = Brit
System location(sys.location ) = First floor lab
System name(sys.name) = sms25
System serial number (sys.serialNum) = X-SMA-ST-SMS25-0001

1-4

SMS Command Line Interface Reference

Remote paths
Several commands accept remote paths as input. The remote paths specify aresource on an external server that can be accessed by the SMS server.
Remote files that can be specified as input to an operation may be accessedusing HTTPS, FTP, NFS, or SMB (Samba) protocols.
Remote directories that are used for saving SMS-based files to a remote
server can be accessed through the NFS or SMB protocols. Files are always
mounted with read-only access. Directories are mounted read-only whenpossible.
Remote paths are specified as a single string value. The details for each
protocol are listed in the following sections. In each example, items in italics
are variables. When using the path syntax, you must replace them with theappropriate values for your paths. Items in brackets ([ ]) are optional.

FTP
You can use the following formats for the FTP protocol:• Complete specification: ftp://[username:password@]server[:port]/
directory/filename• Anonymous FTP: ftp://server/directory/filename• Specifying a user name and password: ftp://username:password@server/directory/filename• FTP Examples:
ftp://10.11.12.13/pub/sms-0.0-0.500.pkg
ftp://steve:password@10.11.12.13/pub/sms-0.0-0.500.pkg

HTTPS
You can use the following format for the HTTPS protocol:• Complete specification: https://[username:password@]server[:port]/directory/filename

1-5

SMS Command Line Interface Reference

NFS
You can use the following formats for the NFS protocol:• Remote directory specification — server:/exportedDirectory• Remote file specification — server:/exportedDirectory/filename• NFS Example: nfsserver.domain.com:/public/upgrades/
sms-0.0-0.500.pkg

SMB (Samba)
You can use the following formats for the SMB protocol:• Remote file specification: //server/sharename/directory/filename• Complete specification: //server/sharename[/directory][/
filename] [-o option-list]

Options can be provided to the SMB mount operation by appending them tothe end of the mount point value, and using a space character to separate thevalues. Options might include the username, password, and workgroup.
Options can be joined together using a comma as a separator.
• SMB Example: //winbox/pub/sms.pkg -oworkgroup=mydomn,username=steve,password=ps111

The help command
The help command returns documentation about the specified command,
object, or attribute.
Syntaxhelp
help --fullhelp --attribs
help object.attrib
help --cmds
help cmd
help --objs

1-6

SMS Command Line Interface Reference

help object
help --backgroundhelp backgroundhelp --topic
help topic

Description
The help command is a non-interactive, read command that returns
documentation about a command, object, or attribute that you specify.
Note
In the help command syntax, you can use the question mark (?)
interchangeably with the word “help.” For example, you could type thefollowing to view documentation about all commands: ? --cmds

Objects and attributes
The following objects and attributes can be used with the help command.
Command

Description

help --fullLists all commands, objects, and attributes

help --attribs

List all attributes

help --objs

Lists all objects or collections of attributes

help --cmds

Lists all commands

help --background

Lists background topics

ExampleTo see documentation about the sys object, type help sys. The system
returns the following results:sys (object)
===

1-7

SMS Command Line Interface ReferenceCollection of system-related attribs. The attribs retain system
values, including the system name, location and contact.
See also:
sys.contact (attrib)
sys.hypervisor (attrib)
sys.location (attrib)
sys.model (attrib)
sys.name (attrib)
sys.platform (attrib)
sys.serialNum (attrib)

SMS command referenceThis section describes the SMS commands and the options available for eachcommand.
Note
To use the SMS CLI, you must be logged in with an account that has SuperUser
rights or the Access SMS CLI capability enabled (on the SMS, go to Admin >Authentication and Authorization > Roles > Capabilities > Admin).

clear
Clears the screen.
Usage
clear

Aliasesclear

cls
Clears the screen.
1-8

SMS Command Line Interface Reference

Usage
cls

Aliasesclear

consoleShows a list of messages that have been sent to the console since the lastreboot.
Usage
consoledate
Displays and sets the system time.
Description
Without a parameter, date will return the current system date and time. The
parameter allows a new date to be specified. Changing the system date will
restart the SMS.
Usage
date [MMDDhhmm[[CC]YY][.ss]]

deleteDeletes user files.
Description
User files are archived and exported. The files are generated from thedatabase contents.
Usage
delete file [...]

1-9

SMS Command Line Interface Reference

Related objects
dir, view, vi

diags
Runs diagnostics tests and checks system health.
Description
The --force option will run diagnostics without prompting for confirmation.
Runs tests for the system, database, network, tmc, and password andprovides status. For tmc, tests the connection to the tmc and the package
server.
Usage
diags[--force]

dir
Returns a listing of files contained in the user directory.
Usage
dir

Related commands
delete, view, vi

dns
Prompts for DNS settings.
Description
The dns command interactively prompts for DNS (Domain Name Service)settings used to resolve host names to IP address values. To clear server
values, use a period (.). The dns object contains default domain name, DNS
search list, and DNS server information.
Usage
dns

1-10

SMS Command Line Interface Reference

Related commands
nic, ntp

Related objects
dns

exit
Closes the session.
Usage
exit

Aliasesquit, Ctrl-D

factoryreset
Resets the system to factory defaults.
Description
This command is an interactive command that resets the system to thefactory defaults. The SMS version is not changed, however, all other systemsettings are restored to the factory defaults and all data is lost. You MUST
reboot the SMS for this command to complete.
The factory reset command also resets the system network settings. You CAN
NOT access the system via networking after the reboot is completed. A VGA
console, or serial port access is required to reconfigure networking so that
network access is restored.
Usage
factoryreset

Related commands
setup

1-11

SMS Command Line Interface Reference

fips-mode
Description
This command is used to configure the SMS into one of two levels of FIPS
operation:
Disabled – When placed into this mode, no additional FIPS complianceactions/restrictions are activated on the SMS.
FIPS crypto core – When placed into this mode, FIPS-approved algorithm
implementations are used for both SSH and TLS connections for the SMS.
Usage
fips-mode

For more information about FIPS mode, see the Security Management System
User Guide.

getRetrieves the value of one or more attribs or a list of attribs contained within
an object.
Usage
get <attrib|object> [...]

Description
The get command can use any read-write or read-only attribute.
Related commands
list, sethelp
Returns background information on various topics and command syntax.
Usage
help [--full | --attribs | --cmds | --objs | --background |topic]

1-12

SMS Command Line Interface Reference

Alias?
OptionDescription--fullLists all commands, objects and attribs.

--attribs

Lists all attribs.

--objsLists all objects (collections of attribs).

--cmdsLists all commands (default).

--background

Lists background topics.

ifconfig
Displays the network settings for the box.
Usage
ifconfig

Description
The ifconfig command is an alias for the command get net, whichdisplays the values of the attribs contained in the net object. To change thevalues, use the set net command.
Aliases
get net, ipconfig

Related objects
net

ipconfig
Displays the network settings for the box.
Usage
ipconfig

1-13

SMS Command Line Interface Reference

Description
The ipconfig command is an alias for the command get net, whichdisplays the values of the attribs contained in the net object. To change thevalues, use the set net command.
Aliases
get net, ifconfig

Related objects
net

kbdcfgLoads the kernel keymap for the console.
Description
The kbdcfg command is useful if the console is using a non-QWERTY
keyboard. This command leads you through setting the layout for yourkeyboard. A complete list of keyboard layouts is not included.
WARNING!
Do not use this option if you are using a standard QWERTY keyboard. Setting
your keyboard layout to a value with which you are not familiar could render
your system inaccessible.

See also
kbd.layout (attrib)

list
Lists the objects or the attribs contained in an object.
Usage
list [object|object attrib] [...]

1-14

SMS Command Line Interface Reference

Description
If no arguments are specified, the list command returns an error. If an
object is specified without an attribute, the list command will return all
attribs contained within the object. If an attribute is specified, the list
command will confirm the attribute by listing the attribute in the response.
Related objects
See SMS attributes and objects on page 1-37 for a list of objects and attribs you
can use with the list command.
See also
get, set

mgmtsettings
Provides prompts to configure IPv4 and IPv6 management addresses, alongwith the default gateway and DNS server(s).
Usagemgmtsettings

Related objects
net

monitorShows utilization and uptime information every five seconds (by default).
Usage
monitor [delay]

Where delay is the number of seconds between polls.
Related objects
health1-15

SMS Command Line Interface Reference

more
Lists output one screen at a time.

nic
Interactively prompts for configuration of the SMS server network settings.
Usage
nic

Description
The nic command is useful for the Ethernet 10/100/1000Mbps interface
management. It Interactively prompts for configuration of the SMS server
network settings. The bottom-most (NIC1) is enabled by default and is therecommended connection to the management network.
Related commands
dns, ntp

nicsettings
Interactively prompts for the SMS NIC configuration settings.
Usagenicsettings

Description
The nicsettings command is an interactive command that prompts for the
SMS NIC configuration settings and is available through the CLI and OBE. If
you want to make changes individually to any of the NIC settings, the SMS
provides options for setting auto negotiation, port speed, and duplex mode.
Examplesms110 SMS=> nicsettings
The Ethernet NIC used for the network management interface isconfigurable. Please verify the port configuration of the

1-16

SMS Command Line Interface Reference

network device that this SMS is connected to before making
changes. These values may be changed at a later time withthe 'set net' command.
Host autoneg: yes
Host speed: 1000
System duplex: fullEnter: [A]ccept, [C]hange, or [E]xit without saving? <[A],C,E>:

Related objects
net

notifyManages the SMS notification service.
Usage
notifyDescription
The notify command is used to manage the SMS notification service. It
interactively prompts for SMTP e-mail addresses and SNMPv1 traps to aremote trap server.
Related objects
smtp, snmp

Related commands
snmp

ntp
Manages the NTP (Network Time Protocol) client. The client synchronizes
the SMS server's time with the specified list of external time servers.
Usage
1-17

SMS Command Line Interface Reference

ntp

Description
The ntp command is used to manage the NTP (Network Time Protocol) clientthat synchronizes the SMS server time with a list of specified servers. NTP isenabled by default and is configured with a list of Stratum 1 servers available
on the internet. The list of servers can be customized to installation
requirements. The SMS server can also act as a NTP server for your devices.
The agent can be disabled, but the server cannot. To clear server values, usea period (.).
Related objects
svc

Related commands
snmp

ntp-authUsage
ntp-auth

Description
The ntp-auth command is used to manage the NTP (Network Time Protocol)
authentication settings. These settings are used with the SMS NTP client andserver. The SMS can act as an NTP server for devices.
Related commands
ntp

password
Changes the password for the current user.
Usage
password

1-18

SMS Command Line Interface Reference

Description
The password command changes the password for the current user.
Password requirements are determined by the password security level of the
SMS. The security level defaults to level 2 (Medium), as described in thefollowing table.
Level
Level 0 (None)

Description• User names cannot contain spaces.
• Password length and complexity are not restricted.
Note
Do not use spaces in the password.

Level 1 (Low)

Passwords must meet Level 0 (None) restrictions and the following:• User names must be at least six characters.
• Passwords must be at least eight characters.
• New password must be different from the previous password.

Level 2
(Medium)

Passwords must meet Level 1 (Low) restrictions and the following:• Must contain at least two alphabetic characters.
• Must contain at least one numeric character.
• Must contain at least one non-alphanumeric character (examples
include ! ? $ * #).

Level 3 (High)

Passwords must meet Level 2 (Medium) restrictions and the following:• Must contain at least 15 alphabetic characters.
• Must contain at least one uppercase character.
• Must contain at least one lowercase character.
• Must be different from the previous password in at least half of thecorresponding character positions.

ping
Checks network connectivity.
1-19

SMS Command Line Interface Reference

Usageping [-options] hostNameOrAddress

Description
The ping command checks network connectivity by sending a ICMP request
to the specified destination, and then checking on an echoed response.
OptionDescription-6

Required to use IPv6.

-c count

Stop after sending count packets.

-i wait

Wait wait seconds between sending eachpacket. The default is to wait for one second
between each packet.

-nNumeric output only. No attempt will bemade to lookup symbolic names for hostaddresses.

-q

Quiet output. Nothing is displayed except thesummary lines at startup time and whenfinished.

-r

Bypass the normal routing tables and send
directly to a host on an attached network. If
the host is not on a directly-attached network,
an error is returned. This option can be used
to ping a local host through an interface thathas no route through it.

-s packetsize

Specifies the number of data bytes to be sent.
The default is 56, which translates into 64
ICMP data bytes when combined with the 8bytes of ICMP header data.

-v

Verbose output.

proxy-config
Enables the SMS to connect to the internet using a proxy server.
Usage
1-20

SMS Command Line Interface Reference

proxy-config

Description
Provides prompts for configuring your SMS to connect to the internet using a
proxy server that you have configured in your environment. When you enter
the command, a series of prompts are displayed to configure the proxysettings, including:• IP address or hostname for the proxy server• Port number for the proxy server• Proxy authentication information• TMC polling interval

quit
Closes the session.
Usage
quit

Alias
exit, Ctrl-D

radiusLists and manages the RADIUS servers.
Usage
radiusDescription
The radius command lists and manages the RADIUS servers. You can create,
edit, and view the RADIUS servers.

rebootReboots the system.
1-21

SMS Command Line Interface Reference

Usage

reboot [--force] [cancel]

Description
The reboot command reboots the system. The --force option reboots thesystem without prompting for confirmation. The cancel option aborts an inprogress reboot.

resolve
Resolves a fully qualified domain name (FQDN) hostname to an IP addressusing the DNS settings.
Usage

resolve <FQDN hostname>

Description
The resolve command resolves a FQDN hostname to an IP address using the
DNS settings. If the name cannot be resolved, it is returned as-is.
See also
reverserestartRestarts the network stack.
Usage

restart [--force]

Description
The restart command restarts the network stack. The -force option
restarts the network stack without a confirmation prompt.

reverse
Performs a reverse-lookup on an IP address or a relative hostname using the
DNS settings.
1-22

SMS Command Line Interface Reference

Usage
reverse <ip-address|FQDN_hostname>

Description
The reverse command performs a reverse-lookup on an IP address or a
relative hostname using the DNS settings. If the value cannot be resolved, it
is returned as-is.
See also
resolveroutesAllows static routes to be added or deleted.
UsageroutesDescription
The routes command allows static routes to be added or deleted for the
network management interface.
Note
Whether or not static route entries are included in routing tables depends on
several topology factors. These include network specificity, metrics, andwhether the next hop IP is on the associated interface. Other routing types,
redistributions, and firewall rules also impact static route entries in therouting tables.

See alsonic (cmd), net (object)

scp
Allows a file to be securely copied to or from the SMS CLI.
1-23

SMS Command Line Interface Reference

Usage
scp

Description
The scp (Secure Copy) command is a remote file copy program that allows afile to be securely copied to or from the SMS CLI. The scp command is only
supported when you run it from the CLI.
To copy a file using scp, you must supply values to the following prompts:
Enter file transfer mode [G]et or [P]ut <G,[P]>:Enter scp server IP address or host name:Enter fully qualified remote file name:Enter local directory or file name: [/]:
Enter login id:
Enter password:

See also
logs (object), delete (cmd), dir (cmd)service-access
Enables or disables service access to the SMS.
Usage
service-access

Description
The service-access command is used to enable or disable service accessto the SMS. The SMS version serial number and salt is displayed whenenabling.
See also
pwd (object)

1-24

SMS Command Line Interface Reference

set
Assigns values to one or more attribs or to a list of attribs contained within
an object.
Usage
set <attrib|object|attrib=value> [...]

Description
The set command assigns values to one or more attribs or to a list of attribs
contained within an object. The list may be a one or more attribute names,
object names, or attrib/object pairs. To accept the current or default value,
type the return key. To clear a String or IP Address value, enter a period (.),
and then the return key.
The set command can use any read-write or write-only attribute. See SMS
attributes and objects on page 1-37.
See also
list, getsetup
Provides essential configuration settings for the SMS server.
Usage
setup

Description
The setup command opens an initial setup wizard for providing essential
configuration settings for the SMS server. Non-essential values can be
configured with other commands.
The setup command is automatically invoked with the first CLI login
session. It is repeated with each new login session until the entire setup
procedure is finally completed. To repeat the procedure, execute the setup
command at any time. The setup procedure prompts you to enter thefollowing information:
1-25

SMS Command Line Interface Reference• Network type (IPv4 default): IPv[4], IPv[6], or [B]oth <4,6,B>• Management IPv4 Address• Network Mask
• IPv4 Default Gateway (optional)• Management IPv6 Address• IPv6 Default Route (optional)• DNS Server-1 (optional)

shutdown
Shuts down and powers off the system.
Usage
shutdown [--force] [cancel]

Description
The shutdown command shuts down and powers off the system. To restart
the system, physically press the POWER button on the front of the unit. The--force option will reboot the system without prompting for confirmation.
The cancel option aborts an in-progress shutdown operation.

snmp
Manages the SNMP (Simple Network Management Protocol) values.
Usage
snmp

snmp-request
Manages the SNMP (Simple Network Management Protocol) request agent.
Usage
snmp-request

1-26

SMS Command Line Interface Reference

Description
The snmp-request command is used to manage the SNMP (Simple Network
Management Protocol) request agent. When enabled, the SMS agent
responds to the SNMP system request. This command prompts you to enable
the SNMP request agent and enter the following information:
Enter the SNMP version: V[2], V[3], or [B]oth <2,3,[B]>:Enter community string []:Enter User Name []:Enter Auth Protocol (None, MD5, or SHA): []:Enter Auth Key: ********************************
Confirm Key:********************************
Enter Privacy Protocol (None, AES-128, AES-192, AES-256, DES or
Triple_DES): []:Enter Priv Key: ********************************
Confirm Key:********************************
Version: Both
Community String:
User Name:
Auth Protocol:
Privacy Protocol:

See also
snmp, snmp-trap

snmp-trap
Manages the SNMP (Simple Network Management Protocol) traps.
Usage

snmp-trap

Description
The snmp-trap command is used to manage the SNMP (Simple Network
Management Protocol) traps. The SMS sends SNMP traps to NMS
1-27

SMS Command Line Interface Reference

destinations. This command prompts you to enable configuration for an
NMS trap destination and enter the following information:
Commands: [A]dd [D]elete [V]ersion [C]ommunity [P]ort [E]ngine[U]ser Au[T]hProto Auth[K]ey P[R]ivProto Pr[I]vKey[L]ist [?]help [Q]uit
Command? <A,D,V,C,P,E,U,T,K,R,I,[L],?,Q>: a
Add=> Enter trap destination address []: 192.168.1.1
Add=> Enter SNMP version: v[2] or v[3] <2,3>: 3
Add=> Enter port number [162]:
Add=> Enter Engine ID []:Add=> Enter User Name []:Enter Auth Protocol (None, MD5, or SHA): []:Enter Auth Key: ********************************
Add=> Confirm Key:********************************
Enter Privacy Protocol (None, AES-128, AES-192, AES-256, DES
or Triple_DES): []:Enter Priv Key: ********************************
Add=> Confirm Key:********************************IP Address: 192.168.1.1
Version: v3
Port: 162
Engine ID:
User Name:
Auth Protocol:
Privacy Protocol:

See also
snmp, snmp-request

1-28

SMS Command Line Interface Reference

snmpgetRequests a single OID from the specified agent.
Usage
snmpget hostNameOrAddress communityName OID

Example (IPv6)
snmpget -v 2c -c public udp6:[fc01:a63:1:0:214:22ff:fe1e:1d87]
system.sysName.0

Example (IPv4)
snmpget -v 2c -c public 10.99.1.110 system.sysName.0

See also
snmpwalk

snmpwalk
Traverses the SNMP MIB of the agent running at the specified address.
Usage
snmpwalk [hostNameOrAddress [communityName [OID]]]

Description
The snmpwalk command traverses the SNMP MIB of the agent running at the
specified address. If the address OID is not provided, the walk begins at thefirst OID, if the community name is not provided, walk with use public andif the hostNameOrAddress is not provided, walk uses localhost.
Example (IPv6)
snmpwalk -v 2c -c public udp6:[fc01:a63:1:0:214:22ff:fe1e:1d87]
systemExample (IPv4)
snmpwalk -v 2c -c public 10.99.1.110 system

1-29

SMS Command Line Interface Reference

Example (IPv3)
snmpwalk -v 3 -u user -l authPriv -a SHA -A authKey -x AES -X
privKey 192.168.1.1 system

See also
snmpgetssh
Logs into a remote machine and executes remote commands from within the
SMS CLI.
Usage
ssh [-1246AaCfgKkMNnqsTtVvXxYyZ] [-b bind_address] [-c cipher_spec][-D [bind_address:]port] [-e escape_char] [-F configfile] [-iidentity_file][-L [bind_address:]port:host:hostport] [-l login_name] [-mmac_spec] [-O ctl_cmd][-o option] [-p port] [-R [bind_address:]port:host:hostport][-S ctl_path][-w local_tun[:remote_tun]] [user@]hostname [command]tacacsLists and manages the TACACS+ servers.
Usage
tacacsDescription
The tacacs command lists and manages the TACACS+ servers. You cancreate, edit, and view the TACACS+ servers.

time
Runs the specified program command with the given arguments.
1-30

SMS Command Line Interface Reference

Usagetime <command> [arguments...]Description
The time command runs the specified program command with the given
arguments. When the command finishes, time writes a message to standard
output giving timing statistics about this program run. These statistics
consist of the elapsed real time between invocation and termination, theuser CPU time, and the system CPU time.
For information about the time object, see time on page 1-90.

touch
Creates user files, which are archived files generated from database content.
Usagetouch fle [...]

See also
delete, dir, view, vi

traceroute
Traces the route an IP packet would follow to a remote host.
Usage
traceroute [-dFInrvx] [-f first_ttl] [-g gateway][-i iface] [-mmax_ttl] [-p port][-q queries][-s src_addr] [-t tos] [-w waittime] [-z pausemsecs] host

Description
The traceroute command attempts to trace the route an IP packet would
follow to a remote host by launching UDP probe packets with a small ttl(time to live) then listening for an ICMP time exceeded reply from a
gateway.
1-31

SMS Command Line Interface Reference

Probes start with a ttl of one and increase by one until we get an ICMP port
unreachable (which means we got to host) or hit a max (which defaults to 30
hops and can be changed with the -m flag). Three probes (change with -q
flag) are sent at each ttl setting and a line is printed showing the ttl,

address of the gateway and round trip time of each probe. If the probe
answers come from different gateways, the address of each responding
system is printed. If there is no response within a five second timeout
interval (changed with the -w flag), an asterisk (*) is printed for that probe.

For IPv4 (-4 flag) or IPv6 (-6 flag) tracerouting can be forced using theappropriate flag. By default, the program tries to resolve the name given andautomatically choose the appropriate protocol. If resolving a host namereturns both IPv4 and IPv6 addresses, traceroute uses IPv4.
Description

Option1-32-4Force IPv4 tracerouting.

-6

Force IPv6 tracerouting.

-f

Set the initial time-to-live used in the first outgoing probe packet.

-F

Set the don’t fragment bit.

-d

Enable socket level debugging.

-gSpecify a loose source route gateway (8 maximum).

-i

Specify a network interface to obtain the source IP address for outgoing probe
packets. This is normally only useful on a multi-homed host. (See the -s flag foranother way to do this).

-I

Use ICMP ECHO instead of UDP datagrams.

-m

Set the max time-to-live (max number of hops) used in outgoing probe packets.
The default is 30 hops (the same default used for TCP connections).

-n

Print hop addresses numerically rather than symbolically and numerically(saves a nameserver address-to-name lookup for each gateway found on thepath).

SMS Command Line Interface Reference

OptionDescription-p

Set the base UDP port number used in probes (default is 33434). Traceroute
hopes that nothing is listening on UDP ports base to base + nhops - 1 at thedestination host (so an ICMP PORT_UNREACHABLE message will be returned toterminate the route tracing). If something is listening on a port in the default
range, this option can be used to pick an unused port range.

-r

Bypass the normal routing tables and send directly to a host on an attachednetwork. If the host is not on a directly-attached network, an error is returned.
This option can be used to ping a local host through an interface that has noroute through it (e.g., after the interface was dropped by routed).

-s

Use the specified IP address as the source address in outgoing probe packets.
This is usually given as an IP address, not a hostname. On multi-homed hosts
with more than one IP address, this option can force the source address to be adifferent IP address than the interface from which the probe packet is sent. If
the IP address is not one of the host’s interface addresses, an error is returnedand nothing is sent.

-t

Set the type-of-service in probe packets to the following value (default zero).
The value must be a decimal integer in the range 0 to 255. This option can beused to see if different types-of-service result in different paths. (If you are notrunning 4.4bsd, this may be academic since the normal network services like ftp
don’t let you control the TOS). Not all values of TOS are legal or meaningful - see
the IP spec for definitions. Useful values are probably ‘-t 16’ (low delay) and ‘-t 8’(high throughput).

-v

Use Verbose output. Received ICMP packets other than TIME_EXCEEDED and

UNREACHABLE values are listed.

-w

Set the time (in seconds) to wait for a response to a probe (default five seconds).

-z

Set the time (in seconds) to pause for a response to a probe.

updateUpgrades the SMS server software.
Usage

update1-33

SMS Command Line Interface Reference

Description
The update command leads you through upgrading SMS server software:
1. Acquire the latest upgrade package from the TMC website.
2. Save it to a local HTTPS or FTP server that can be accessed by the SMS
server.
3. Provide the URL to this downloaded file.
After the package is transferred and installed, the update procedure prompts
for a reboot.
Related attributectl.upgrade-source

users
Lists and manages the SMS user accounts.
Usage
users

Description
The users command lists and manages the SMS user accounts. You cancreate new users and assign or change passwords, roles, disable settings, andforce password changes.
Related object
pwd

version
Displays the system and component versions.
Usageversion

1-34

SMS Command Line Interface Reference

Related object
sw

vi
Edits plain text.
Usagevi [options] [file ...]

Description
vi is a text editor that is comparable to Vi. It can be used to edit all kinds ofplain text. It is especially useful for editing programs. While running vi, a lotof help can be obtained from the on-line help system, with the :help
command.
Caveats/tmp and its contents are the only files and directories that the SuperUser
account has permission to modify. When accessing files you must specify thecomplete path name (for example: vi /tmp/FileName.txt). After sevendays without modification, files in this directory are removed.

Options
The options may be given in any order, before or after filenames. Options
without an argument can be combined after a single dash.
OptionDescription+num

For the first file the cursor will be positioned on line num. If num is missing, thecursor will be positioned on the last line.

+/{pat}

For the first file the cursor will be positioned on the first occurrence of {pat}. See“:help search-pattern” for the available search patterns.

-hGive a bit of help about the command line arguments and options. After this, Vi
exits.

1-35

SMS Command Line Interface Reference

OptionDescription-mModifying files is disabled. Resets the write option, so that writing files is notpossible.

-n

No swap file will be used. Recovery after a crash will be impossible. Handy if you
want to edit a file on a very slow medium (e.g. floppy). Can also be donewith :set uc=0.Can be undone with :set uc=200.

-R

Read-only mode. The read-only option will be set. You can still edit the buffer,
but will be prevented from accidently overwriting a file. If you do want to
overwrite a file, add an exclamation mark to the Ex command, as in:w!. The -R
option also implies the -n option (see below). The read-only option can be resetwith :set noro. See :help ‘read-only’.

-r {file}

Recovery mode. The swap file is used to recover a crashed editing session. The
swap file is a file with the same filename as the text file with .swp appended.
See :help recovery.

--

Denotes the end of the options. Arguments after this will be handled as a file
name. This can be used to edit a filename that starts with a dash (-).

--help

Give a help message and exit, just like -h.

--version

Print version information and exit.

See also
dir, delete, view

view
Displays the contents of the directory.
Usage
view

Description
The view command allows you to view the contents of the directory. Internal
help is available by typing a question mark (?)

1-36

SMS Command Line Interface Reference

See also
delete, dir, vi

webInteractively prompts for configuration of web server settings.
Usage
web

Description
The web command interactively prompts for configuration of web server
settings. HTTPS services can be enabled through the web command.
Additionally, a single password can be assigned to the content to limit accessto reports, archived data, documentation, and client downloads. The username used for access is web and the password is assigned with the web
command.
See also
snmp

who
Displays a list of CLI users, where and when the users originated.
Usage
who

See also
health.who

SMS attributes and objects
This section describes each object and attribute used by the SMS CLI. For
more detailed information about each element, see the individualcommands described in SMS command reference on page 1-8.
1-37

SMS Command Line Interface ReferenceNote
To use the SMS CLI, you must be logged in with an account that has
SuperUser rights.

Attribute types
Describes each type of attribute (attrib) that you can view or edit in the CLI.
The following table describes each type of attribute (attrib) that you can viewor edit in the CLI.
Type

Definition

Bool

Boolean. Value can be true or false.

String[#]String. Can have a maximum size of #.

Password

String. Uses asterisk (*) to mask out the value as it is entered.

IPaddrIP address. Uses dotted notation.

Name [#]

String. Can contain alpha-numeric characters with a maximum size of #.

Int

Integer. Whole number that falls within the lower and upper limits specified byeach attribute.

cac
Disables the CAC authentication mode and sets the mode to SMS local
authentication.

1-38

SMS Command Line Interface Reference

Attribute
cac.disable

Description

Type

AccessRange

Setting the cac.disable attrib to thevalue of true will cause the system todisable the CAC authentication mode,
which sets the SMS back to the default
authentication mode (local
authentication).

Boolwriteonly0This command should only be used
when users with SuperUser capabilities
are not able to log in to the SMS client
using the CAC card reader.

cli
Adjusts CLI behavior. Collection of CLI-related attribs. The attribs are used toadjust CLI behavior, including the inactivity timeout value.
Attribute
cli.sessionTimeout

Description
Attribute used to control the autologout time. By adjusting the value,
you can control the number ofminutes before the CLI willautomatically log out due toinactivity. Set the value to 0 to
disable the timeout function.
Example:

Typ
e

Acces
s

Int

readwrite

Range
0-32000

set cli.sessionTimeout=30

ctl
Restart, reboot, shut down the system, or accesses the upgrade capability.
Collection of system control operations. The attributes contained in ctl canbe used to reboot or shutdown the system, or access the upgrade capability.
See Remote paths on page 1-5 for more information about entering path
names for attributes that require them.

1-39

SMS Command Line Interface Reference

Attribute

1-40

Description

Type

AccessRange

ctl.power-off

Setting the ctl.power-off attrib to
the value of true will cause the system
to shutdown and power-off. To restart
the system, it is necessary to physicallypress the Power button on the front
panel of the box.

Boolwriteonly0

ctl.reboot

Setting the ctl.reboot attrib to thevalue of true will cause your entire
system to reboot. The operation will be
immediate with no warning given toother users using the client or the CLI.

Bool

writeonly0

ctl.restart

Setting the ctl.restart attrib to thevalue of true will cause the system to
immediately restart. Set a value (inseconds) for the SMS to delay before
restarting.

Stringwriteonly

true/
false,
0-9

ctl.rebootneeded

Returns the state of the system,
indicating whether there are pending
configuration settings that require a
reboot to apply those changes.

Boolreadonly0ctl.pre-upgradecleanup

Performs any system cleanup necessary
for an SMS upgrade. Updates that the
upgrade can occur. This command isalso run automatically when an SMS
upgrade is requested. The upgrade will
fail if this command fails.

Boolwriteonly

0SMS Command Line Interface Reference

Attribute
ctl.upgradesource

Description

Type

AccessRange

Setting the ctl.upgrade-source
attrib to a string representing a URL willcause the system to retrieve and apply
the update package to the system.
Normally, a reboot will be required forthe update to become effective. The
URL can reference http or ftp protocols.

Stringwriteonly

5-128

Stringreadonly

5-128

Bool

readonly

true/
false

Example:set ctl.upgradesource=https://www.
tippingpoint.com/SMSUPDATE-1.0.pkg
ctl.patchreleasenotes

Used to display the release notes for
currently installed Patch.
NoteThis attribute is used by the UI
to retrieve release notes and isof little interest to general cli
users.

ctl.patchrestart

Used to display restart flag for currently
installed Patch. This attribute is used by
the UI to retrieve restart flag and is oflittle interest to general cli users.

1-41

SMS Command Line Interface Reference

Attribute
ctl.patchrollback

Description

Type

AccessRange

Used to roll back to previous patch
version. Displays true if the currently
installed Patch can be rolled back, else
false. If set to the version of thecurrently installed Patch, it rolls it back,to either the previously installed Patchor no Patch if it was the first Patch
installed.

Bool

readwrite

true/
false

Note
This attribute is used by the UI
to retrieve this value and is oflittle interest to general cli
users.
ctl.patch-source

Used by the UI for installing Patches.
Similar to set ctl.upgrade-source, thistakes a path or url to the Patch package
file, then validates and installs that
Patch.

Stringwriteonly

5-128

ctl.previouspatch-version

Used to display the version of the Patch
previous to this, for example the Patch arollback would install, or None if there is
no previous Patch.

Stringreadonly

5-128

sw.patch-version

Used to display the version number ofthe currently installed Patch, or None if
no patch is installed.

Stringreadonly

5-128

dbCollection of database control operations.
The attribs contained in db can be used to backup, restore or re-initialize thesystem database. See Remote paths on page 1-5 for more information aboutentering path names for attribs that require them.

1-42

SMS Command Line Interface Reference

On startup, the sequence performed is (1) if requested, backup the database,(2) if requested, restore the database, (3) if requested, reinit the database, (4)if needed, migrate the database. Therefore, within a single restart, a current
database can be saved to a remote system, and a new database can replace
the old one. To clear a current value, set the attribute to a period (.).
Attribute

Description

Type

AccessRangedb.attackCount

Displays the number of attack records
stored in the database.

Int

read-only

0db.attackLimit

Maximum number of attack records.

Int

read-only0db.backup

Setting the db.backup attrib to yes
creates a local database backup withdefault options. This file can be
downloaded from the Exports andArchives link from the SMS Server home
page.

Bool

writeonly

db.check

Verifies the integrity of the database. Set
this attribute to yes in order to verify.

Boolreadwrite

db.clear-export

Deletes files in the export directory. Set
this attribute to yes in order to delete thefiles.

Bool

readwrite

db.export-files

Files to be saved and transported to aremote system can be stored in the export
directory. To transfer the entire contentsof the export directory this attrib must be
provided with the name of a Samba (SMB)
mount point.
The destination mount point must be
writable by the SMS server. SMB can be
secured by providing an access list on theserver that prevents all machines except
for the SMS server to access it. The export
directory can be cleared by setting the
db.clear-export attrib.

Strin
g

writeonly

4-132

Example:set db.exportfiles=server:/export/ directory

1-43

SMS Command Line Interface Reference

Attribute

Description

Type

AccessRangedb.externalvm

Enables external vulnerability
management.

Boolreadwrite

db.initTime

The time that the database was reinitialized.

Strin
g

read-only

0-32

db.reinit

Setting the db.reinit attrib to true willschedule the database to be cleared uponsystem startup the next time the system isrebooted.

Bool

readwrite

0

dns
Contains default domain name, DNS search list and DNS server information.
The dns object contains default domain name, DNS search list and DNS
server information.
Description

Type

AccessRange

dns.domain

Default DNS domain used to resolve
hostnames. If a fully-qualified hostname is
not provided, the domain is appended tothe hostname and the result is passed for
resolution.

Name

readwrite

2-64

dns.search

DNS domain search list used to resolve
hostnames. If a fully-qualified hostname is
not provided, each member of the search
list is appended to the hostname and theresult is passed for resolution.

Stringreadwrite

2-128

dns.server1

Attribs used to specify name resolution
servers. The value must be a dotted IP
address, and the first entry(dns.server1) will be assigned apreferred role.

IPaddrreadwrite

7-15

Attributedns.server2
dns.server3

To clear this value, use a period (.).

1-44

SMS Command Line Interface Reference

Related objects
nic, ntp

high availability
Retrieves HA information. Collection of system High Availability (HA)
attribs. The attribs are used to retrieve HA information.

1-45

SMS Command Line Interface Reference

Attributeha.status

Description

Type

Acces
s

Attribute returning the status of HA.
The status messages include the following:

Stringreadonly

Stringwriteonly

Range• Disabled: High Availability is
not configured.

• Enabled.
• Error: The system could not
determine local status.

• Error: Unable to communicate
with peer.

• Error: Peer system state isinvalid.

• Error: Configuration out ofsync with peer.

• Error: Peer system failure.
• Configured: Synchronization
required.

• Configured: Attempting
synchronization.

• Configured: Synchronizing.
• Degraded: Peer takeoverpending.

• Degraded: Unable tocommunicate with peer.

• Degraded: Synchronization
required.

• Degraded: Peer system failure.

1-46

ha.disable

Attribute that disables HA.

ha.configured

Attribute returning the status of the HA
configuration.

readonly

1-10
24

SMS Command Line Interface Reference

Attribute
ha.portsenabled

Description

Type

Acces
s

Attribute returning the status of the HA
ports. By default, HA ports are open. To
disable, use set ha.ports-enable = no.

Stringreadwrite

Bool

readonly

Ran
ge

Note
If any of your SMS devices are
currently configured for HA, the HA
ports on those systems cannot bedisabled. If the HA ports are
disabled, that SMS can not be usedin an HA configuration.
ha.encrypt

Encrypts replicated data. This option does
not affect data replication during
synchronization, which automatically occurs
over a secure channel.

ha.cluster-info

Attribute returning the detailed status for
the Passive and Active systems in the SMS
HA cluster.

readonly

healthRetrieve system health information, including utilization values, and system
uptime statistics. Collection of system health-related attribs, which include
utilization values and system uptime statistics.
Attributehealth.cpu-util

Description

Type

Acces
s

Rang
e

Attribute returning the CPU(Processor) utilization. 0% represents
a near-idle system, and 100% is fullyutilized.

Int

readonly

0-100

1-47

SMS Command Line Interface Reference

Attribute

Description

Type

Acces
s

health.db-valid

Attribute reporting the status of thedatabase. If OK, then the database isconsidered valid and fully
operational; for any other value,
restart the system and follow thecorrective steps.

Strin
g

readonly

health.diskIo

Disk I/O statistics.

Int

readonly• blocks-read• blocks-written
health.disk-util

Attribute returning the disk systemutilization. As disk utilization
approaches 100%, databasemanagement operations should be
performed to reduce disk usage.

Strin
g

readonly

health.loadAvg

CPU load statistics.

Strin
g

readonlyStringreadonly• load-avg-1min• load-avg-5min• load-avg-15min• runnable-processes/totalprocesses• current-pid
health.memInfo

Physical memory statistics.
• total• used• free• buffers• cached

1-48

Rang
e

SMS Command Line Interface Reference

Attribute

Description

Type

Acces
s

Rang
e

health.mem-util

Attribute returning the memory (RAM)utilization. 0% represents a near-idle
system, and 100% is fully-utilized.

Strin
g

readonly

0-100

health.raid

Attribute returns the status of thephysical disks in your RAID
configuration on the H3 and H3 XL
platforms.

Strin
g

readonly

health.net-valid

Attribute reporting the status of thecommunication paths. Checks to see
if network is configured and enabled.
If OK, then it is operational, and will
check the status of the gateway, DNS,
and NTP.

Stringreadonly

health.port-health

Attribute returning Port Statistics of
the SMS. This information
corresponds to the Ports Statistics
table on the Port Health screen (SMS
Health) in the UI with all 12 numbers
printed in a single line. The six
numbers are for the primary port andthe second six numbers are for thesecondary port. Each set of numbers
corresponds to the following tableheadings:

Stringreadonly• total input bytes• total output bytes• total input discards• total output discards• total input errors• total output errors

1-49

SMS Command Line Interface Reference

Attributehealth.swapInfo

Description
Swap memory statistics.
• total

Type

Acces
s

Rang
e

Strin
g

readonly

0-128

Strin
g

readonly

0-128• used• freehealth.swapIo

Swap I/O statistics.
• blocks-read• blocks-written

1-50

health.sys-valid

Attribute reporting the status of the
SMS server application. If OK, then thesystem is considered valid and fully
operational. If not operational, anerror message is returned, the systemshould be restarted, and othercorrective steps taken.

Strin
g

readonly

1-32

health.temperature

Attribute returning the temperature of
the SMS (in degrees Celsius). Displays
n/a for a vSMS. This information
corresponds to the SMS Health
Statistics table in the UI. NOTE: The
number is displayed with no indication
for Celsius.

Strin
g

readonly

1-3

SMS Command Line Interface Reference

Attributehealth.tmc-valid

Description

Type

Attribute reporting the status of thecommunication paths to the TMC andeach of the configured devices. The
message will indicate the nature of
the problem. Usually, the problem
can be addressed by confirming thatthe network settings permit the SMS
to communicate with https://
tmc.tippingpoint.com, available
through the internet. See also diags.

Acces
s

Rang
e

readonlyIf the SMS cannot establish a TMC
connection, see error messages in the
SMS User Guide.
health.uptime

Attribute reporting the amount oftime since the last system boot.

Strin
g

readonly

2-56

health.who

Attribute reporting a list of currently
logged-in users. Pipe (|) characters areused in place of carriage-return
characters.

Strin
g

readonly

0-102
4

kbd
Keyboard-related attribute.
WARNING!
Do not use this option if you are using a standard QWERTY keyboard. Setting
your keyboard layout to a value with which you are not familiar could render
your system inaccessible.

1-51

SMS Command Line Interface Reference

Attribute
kbd.layout

Description
Specifies the console keyboard layout.
Usage: set kbd.layout=keyboard
designation<>
Example setting: fr for French keyboard
layout.
The default setting is kbd.layout=us

1-52

Type

AccessRange

Stringreadwrite

0-64

SMS Command Line Interface Reference

The following console keyboard layouts are available.

1-53

SMS Command Line Interface Reference

Related command
kbdcfglogs
Manages log files that are used for troubleshooting.
Collection of log-related attribs. The attribs are used to manage log files thatare used for troubleshooting.
The logs zip file, sms_logs.zip, is managed in the /mgmt/client/tmp
directory. This is the standard location for cli data files and also allows accessfrom the Exports and Archives link on the SMS web page. Creating a newlogs zip file overwrites the old one.
Description

Type

AccessRange

set logs.create=yes

Creates the logs zip file
sms_logs.zip.

Boolwrite-only0

set logs.del=yes

Deletes the zip file.

Boolwrite-only0

set logs.createpeer=yes

Attribute used to create acompressed file containing
the HA peer SMS log files. This
file can be downloaded fromthe Exports and Archives linkfrom the SMS server home
page. Only the last createdcompressed file of peer logs isretained.

Stringwrite-only0

Stringread-only

0-1024Attribute

Note: This attribute can beused only when HA has been
configured.
get logs.info

1-54

If the zip file exists, lists name,size, date and time ofcreation.

SMS Command Line Interface Reference

Related objects
scp

netCollection of network-related attribs.
Collection of network-related attribs. The attribs are used to configure thetwo Ethernet 10/100/1000 interfaces for access to the local network. Unlessidentified as a net-only attrib, each attrib listed as net.* below can use theprefixnet to specify the correct Ethernet10/100/1000 interface.
ExampleTo change the IP address and gateway for the SMS server, you must complete
the following:
1. Change the IP address by entering the command:
set net.ipaddr = smsip4addr

OR
set net.ipaddr6 = smsip6addr

where smsip4addr is the new IPv4 address, smsip6addr is the new IPv6
address.
2. Change the gateway by entering the command:
Restart the network stack by entering the command:
set net.gateway = ipv4gatewayOR
set net.gateway6 = ipv6gateway

where ipv4gateway is the IP address of the new gateway, ipv6gateway
is the IPv6 address of the new IPv6 gateway.
3. Restart the network stack by entering the command:
set net.restart = yes

1-55

SMS Command Line Interface Reference

The system prompts you to confirm that you want to restart the network
stack. Your changes are applied when the network stack is restarted.
Note
You must issue the set net.restart=yes command when you modify the IP
address or gateway using the set net command. Changes to these attributes do
not take effect until you issue this command. A reboot (reboot command)should be done after you issue the above command.

For information on set net, see set on page 1-25.
Related commands
ifconfig, ipconfig, mgmtsettings

Related objects
dns

net attributes
Attribute
net.autoneg

Description
Attribute used to view, and enable/
disable auto-negotiation for the
Ethernet 10/100/1000 interface.

Type

Access

Rang
e

Bool

readwrite

0Stringreadwrite

4

Valid values are: yes or no.
net.duplex

1-56

Attribute used to view and change
the duplex setting for the Ethernet
10/100/1000 interface.
Valid values are: half or full.

SMS Command Line Interface Reference

Attribute

Description

Type

AccessRang
enet.gateway

Attribute used to provide thegateway (default route) value. To
clear this value, use a period (.).
Applies only the net object.
The network interface must be
restarted (net.restart) for setting totake effect.

IPaddrreadwrite

0

net.gateway6

Attribute used to provide the IPv6
gateway value. To clear this value,
use a period (.). Applies only the net
object.
The network interface must be
restarted (net.restart) for setting totake effect.

IPaddrreadwrite

0

net.hwaddr

Attribute used to return the
Hardware / MAC (Media AccessControl) address for the
Ethernet10/100/1000 interface.

Stringreadonly

17

net.ifc-enable

Attrib used to enable/disable the NIC.
Normally, this should not be done. To
enable the NIC set the value to true,
to disable the value should be set tofalse.

Bool

readwrite

0

net.ipaddr

Attribute used to view and change
the IP address for the
Ethernet10/100/1000 interface. To
clear this value, use a period (.).
Applies only the net object. The
network interface must be restarted(net.restart) for setting to take effect.
When you employ this command, the
CLI may not reflect the change with aconfirmation message.

IPaddrreadwrite

0

1-57

SMS Command Line Interface Reference

Attribute
net.ipaddr6

Description

Type

AccessRangeAttribute used to view and change
the IPv6 address. To clear this value,
use a period (.). Applies only the net
object.
The network interface must be
restarted (net.restart) for setting totake effect. When you employ thiscommand, the CLI may not reflect
the change with a confirmation
message.

IPaddrreadwrite

0Note
The IP address uses IPv6
notation.

1-58

net.mask

Attribute used to provide the subnet
mask value. To clear this value, use aperiod (.).

IPaddrreadwrite

0

net.mtu

Attribute used to view the MTU(Maximum Transmission Unit) for the
SMS Ethernet 10/100/1000 interface.

Int

readonly0

net.ready

Returns "true" if the primary network
interface is configured and ready.

Boolreadonly0SMS Command Line Interface Reference

Attribute
net.restart

Description
Attribute used restart the
Ethernet10/100/1000 interface withthe current network settings. Set totrue to restart immediately. (false
has no effect.)Type

Access

Rang
e

Bool

writeonly0

Stringreadonly0

WARNING!
restarting the network
interface may cause
connections to be lost,
including SMS client
sessions, and remote CLI
sessions. Applies only thenet object.
net.scope-link

Attribute used to return the IPv6
Scope Link address for the
Ethernet 10/100/1000 interface. See
net on page 1-55 and the associatednet.ipaddr6 attribute).
See also ifconfig on page 1-13 andipconfig on page 1-13.

net.speed

Returns the network speed. Valid
speeds are 10 MB, 100 MB, and 1000
MB.

Int

readwrite(readonly forvSMS)

net.autoneg

Attribute used to view, and enable/
disable auto-negotiation for the
Ethernet 10/100/1000 interface.
Valid values are: yes or no.

Boolreadwrite

01-59

SMS Command Line Interface Reference

ntpCollection of NTP (Network Time Protocol) settings used to synchronize thesystem time with a remote time server. NTP allows machines within a
network to be synchronized on a common time.
Related objects
svc, snmp

ntp attributes
Attributentp.authclient-enable

Description

Type

AccessRange

Attribute used to enable/disable theNTP (Network Time Protocol) client
authentication. It allows the SMS torequest authenticated time as an NTP
client where the NTP server is verified
as a known and trusted host. Whenenabled, all nonsecure NTP
authentication is disabled, which
prevents an intruder from intentionallymasquerading as that server. This also
prevents a user from accidentally fallingback to a nonauthenticated NTP server.
NTP symmetric key authentication wasadded in NTPv3 and is supported in
NTPv4.
To enable the NTP client
authentication, set the value to 'yes',
and a key id and key value should be
provided with the ntp.auth-clientKeyId
and ntp.auth-keyValue attribs or ntpauth command. Set the value to no todisable.

Bool

readwrite

0

Example: set ntp.auth-clientenable=yes

1-60

SMS Command Line Interface Reference

Attribute

Description

Type

AccessRange

ntp.authclientKeyId

The key id used by the SMS to request
authenticated time as an NTP clientfrom an NTP server that is configured
with an associated key.

Int

readwrite

1-65535

ntp.auth-keyIdadd

Attribute used to create a new key ID
that can be used with an authenticated
NTP.

Int

writeonly

1-65535

ntp.auth-keyIddel

Attribute used to delete a key ID thatcan be used with an authenticated NTP.

Int

writeonly

1-65535

ntp.auth-keyIds

Lists all the key IDs used with NTP
authentication. The existence of thekeys will automatically allow the SMS
to provide authenticated time to NTP
clients that are configured to request
authenticated time with an associatedkey. Optionally, ntp.authclientKeyId can be set to one ofthese key ids to allow the SMS torequest authenticated time as an NTP
client (set ntp.auth-clientenable=yes).

Intread-only

1-65535

ntp.authkeyType

The key type associated with a unique
key ID and key value that can be usedwith client- and server-authenticated
NTP requests. The string can be
between 1 and 4 characters. The typemust be MD5 or SHA1. The default key
type is set to SHA1.

Stringreadwrite

1-4
MD5,
SHA1

Examples:get ntp.auth-keyType?1
set ntp.auth-keyType?1=SHA1

1-61

SMS Command Line Interface Reference

Attributentp.authkeyValue

Description

Type

AccessRange

The key value associated with a key ID
that can be used with client and server
authenticated NTP requests.

Passw
ord

writeonly

3-40

The client and server must configure
the same key value for this key ID;
otherwise, no relationship between theclient and server is possible.
NTP Authentication supports
symmetric key values with a minimumof 3 characters and a maximum of 40
characters (#, &, and space characters
are not supported). Self-ecoding is not
required; all key values are encoded
automatically based on key length
during configuration.
• Values ranging from 3 to 20
characters in length are encodedand validated as ASCII (20recommended).
• Values ranging from 21 to 40
characters in length are encodedand validated as hexadecimal (40recommended).
Example: set ntp.auth-keyValue?
1=mypasswd

1-62

SMS Command Line Interface Reference

Attributentp.clients

Description

Type

AccessAttribute used to list NTP clients/hoststhat have successfully polled the SMS
to synchronize their time. The hosts arelisted by their IP address. Each row
shows data for a single host.

IPaddrread-only

Range

Hosts on this list generally represent
any managed devices that have been
configured to synchronize their timewith the SMS as a time source.
Data for each host includes:• Hostname – The IP address of theclient.
• NTP – The number of NTP packets
received from the client.
• Drop – The number of NTP packets
dropped to limit the response rate.
• Int – The average interval between
NTP packets.
• IntL – The average interval
between NTP packets after limiting
the response rate.
• Last – Time since the last NTP
packet was received.
• Cmd – The number of command
packets or NTS-KE connections
received/accepted from the client.
• Drop – The number of command
packets or NTS-KE connections
dropped to limit the response rate.
• Int – The average interval between
command packets or NTS-KE
connections.
• Last – Time since the lastcommand packet or NTS-KE

1-63

SMS Command Line Interface Reference

Attribute

Description

Type

AccessRange

IPaddrreadwrite

7-15

connection was received/
accepted.
Because of the nature of the commandchannel, you normally see a host listed
for host 127.0.0.1.
ntp.server1
ntp.server2
ntp.server3

List of attributes (ntp.server1,
ntp.server2, ntp.server3) used to

specify a list of NTP time servers. The
value can be a valid IPv4 or IPv6
address, or a hostname. To use ahostname you must ensure that nameresolution is enabled. To learn how to
do this refer to the dns.server1,
dns.server2, and dns.server3
attribute help topics.

The first entry (ntp.server1) will beassigned the preferred time server role.
The preferred time server is also used
as a step ticker, which adjusts the time
immediately upon system boot.
To clear this value, use a period (.).

1-64

SMS Command Line Interface Reference

Attributentp.status

Description

Type

AccessAttribute used to list the status of theconfigured SMS NTP servers(ntp.server1, ntp.server2,
ntp.server3) by their IP address.
Each server has the following strings:

Stringread-only

Range• MS – Mode and State. This column
provides information about thesource's synchronization modeand status.
Mode – ^ server, = peer, # local
clockState – * current best, + combined,- not combined, x error, ~ highvariability, ? unstable• Name/IP address – The SMS
displays the IP address of any
configured servers.
• Stratum – The stratum level of the
NTP server. This value represents
the distance from a reference
clock. Lower stratum values
indicate sources closer to thereference clock.
• Poll – The polling rate. This isrepresented as a base-2 logarithmof the interval in seconds. For
example, a value of 6 indicates thata measurement is being madeevery 64 seconds. The polling rate
automatically adjusts the response
to prevailing conditions.
• Reach – The server's ability to bereached as an octal number. The
reach value is an 8-bit register thatgets updated with every received
or missed packet from the server. A
value of 377 indicates that a valid

1-65

SMS Command Line Interface Reference

Attribute

DescriptionType

replay was received for all of thelast eight time-sync requests.
• LastRx – Last received sample.
This column shows how long ago
the last sample was received fromthe source. Although normallydisplayed in seconds (s), the value
can also be in minutes (m), hours(h), days (d), or years (y).This isnormally in seconds.
• Last sample – This column
shows the offset between the local
clock and the server at the lastmeasurement. The number in thesquare brackets shows the actual
measured offset. This can be
suffixed by ns (nanoseconds), us(microseconds), ms (milliseconds),
or s (seconds).
The number to the left of thesquare brackets shows the original
measurement, adjusted for any
slews that might have since been
applied to the local clock.
The number following the +/indicator shows the margin oferror in the measurement.
Positive offsets indicate that the
local clock is ahead of the source.

pkg
Collection of attribs used to control package management.
Related objects
tmc (object)

1-66

AccessRange

SMS Command Line Interface Reference

pkg attributes
Attribute

Description

Type

Acces
s

Range

auto-download

Attrib used to control whether new packages
available at the TMC are automaticallydownloaded. Email will be generated to notify
the administrator of the action (if configured).

Bool

readwrite

0auto-install

Attrib used to control whether the SMS
database is updated with the newly
downloaded package.

Bool

readwrite

0

dv-activate

Attrib used to activate a DV package.

Stringwriteonly

dv-delete

Attrib used to delete a DV package.

Stringwriteonly

dv-import

Attrib used to import a DV package to the SMS
using a URL.

Stringwriteonly

dv-info

Attrib used to list all of the DV packages
installed on the SMS.

Stringreadonly

auto-distrib

Attrib used to control whether the new
package will be distributed to the managed
devices.

Bool

readwrite

proxy-tmc

Connect to TMC through HTTP proxy.

Boolreadwrite

proxy-tmc authenticate

Enable TMC proxy authentication

Bool

readwrite

01-67

SMS Command Line Interface Reference

Attribute

Description

tmc-poll-rate

Attrib used to control the frequency of thecheck for new TMC packages. The SMS polls
the Threat Management Center (TMC) atregular intervals (factory default is 30
minutes). Communication is attempted over
TCP port 4043 to the host
tmc.tippingpoint.com. A follow-up requestthat pulls the file may be made to anotherserver using port 443.

Type

Acces
s

Range

Int

readwrite

0-9999The poll rate can be adjusted by providing the
pkg.tmc-poll-rate attrib with a new value
and then rebooting the SMS.
Assigning the attrib the value of '0' disables
polling. (This setting may be desirable when
the SMS is behind a firewall which prevents
outbound communication with the TMC.)
tmc-roxy-host

HTTP proxy TCP/IP server for TMC access.

Stringreadwrite

tmc-roxy-port

HTTP proxy TCP/IP port for TMC accessInt

readwrite

3128

pwd
Collection of password-related attribs. Collection of password-related attribs.
The attribs are used to confirm the SuperUser password and enable theservice mode used by support personnel. For information about managing
users including user groups, passwords, and security levels, see the“Administration” chapter in the SMS User Guide.
Related command
users

1-68

SMS Command Line Interface Reference

pwd attributes
Attribute

Description

Type

Accesspwd.groupadduser

Used to add a user to a user group.

Stringwriteonly

pwd.groupdeluser

Used to remove a user from a user group.

Stringwriteonly

pwd.group-list

Used to list all groups, or groups withusers.

Stringreadonly

pwd.level

Attribute used to set the security level forthe password.

Int

readwrite

pwd.serviceenable

Used to enable/disable the service mode
password for the system.
To protect customer security, the service
mode is deactivated at the factory. To
enable the service mode account, thecustomer must log in with an account that
has SuperUser rights and set this attrib toyes. After service mode is enabled, aservice professional can log in to thesystem with a secret one-time password.
To disable service mode, set the attrib to
no.

Bool

readwrite

Stringwriteonly

Rang
e

0

To clear this value, use a period (.).
Example: set pwd.serviceenable=false
pwd.user-add

Used to add a user and specify the user’s
default user group. User names mustcomply with the rules defined by
pwd.level. You must also specify a usergroup in the form of ?
usergroup=username.
Example: set pwd.user-add?
superuser= johnsmith

1-69

SMS Command Line Interface Reference

Attribute

Description

Type

Accesspwd.user-age

Attribute used to set the maximum age fora password.

Int

readwrite

pwd.user-del

Used to delete a user.

Stringwriteonly

pwd.user-desc

Attribute used to describe the user
account.

Stringreadwrite

pwd.user-email

Attribute used for the user account email
address.

Emailreadwrite

pwd.userexpires

Attribute used to enable password
expiration.

Bool

readwrite

pwd.userexpiredays

Attribute used to set the amount of days tocheck the account for expiration.

Stringreadonly

pwd.userforce-pwd

Attribute used to force a user to change
their password at next login

Boolreadwrite

pwd.user-pager

Attribute used to include the user accountpager number.

Stringreadwrite

pwd.user-phone

Attribute used to include the user accountphone number.

Stringreadwrite

pwd.user-pwd

Attribute used for the user accountpassword.

Stringwriteonly

pwd.user-state

Attribute for the state for the user ID.

Stringreadwrite

radiusCollection of radius-related attribs. The attribs are used to enable andconfigure RADIUS for the SMS. For information about managing users
including user groups, passwords, and security levels, see the“Administration” chapter in the SMS User Guide.

1-70

Rang
e

SMS Command Line Interface Reference

Radius attributes
Attribute

Type

Acces
s

Attribute used to enable/disable
RADIUS.

Bool

readwrite

radius1.secret

Attrib used to enter the RADIUS
secret set by the RADIUS server
administrator. This entry is used byeach RADIUS client, including the
SMS server.

Stringreadwrite

radius1.server

Attrib used to set the IP address of
the RADIUS server.

IPaddrreadwrite

0

radius1.port

Attrib used to set the port on the
RADIUS server that listens forauthentication requests

Int

readwrite

1-65535

radius1.timeout

Attrib used to set the maximum
timeout period in seconds.

Int

readwrite

1-14

radius1.auth

Attrib to set the authentication
method (PAP and EAPMD5)Stringreadwrite

radius2.secret

Attrib used to enter the RADIUS
secret set by the RADIUS server
administrator. This entry is used byeach RADIUS client, including the
SMS server.

Stringreadwrite

radius2.server

Attrib used to set the IP address of
the RADIUS server.

IPaddrreadwrite

0

radius2.port

Attrib used to set the port on the
RADIUS server that listens forauthentication requests

Int

readwrite

1-65535

radius.enable

Description

Range

Primary RADIUS Server

Backup RADIUS Server

1-71

SMS Command Line Interface Reference

Attribute

Description

Type

Acces
s

Range
1-14

radius2.timeout

Attrib used to set the maximum
timeout period in seconds.

Int

readwrite

radius2.auth

Attrib to set the authentication
method (PAP and EAPMD5)Stringreadwrite

route
Collection of network-related attribs. Collection of network-related attribs.
The attribs are used to used to configure the Ethernet 10/100/1000 interface
for access to the local network.
Usage
route.add
route.add <destination> <mask> <gateway>
route.del <destination> <mask> <gateway>

Related objects
route6, net

Related commands
ifconfig, ipconfig, routes

route attributes
Attribute
route.add

Description

Type

Acces
s

Rang
e

Attribute used to add a static routeto the IP routing table.Usage:

IPaddrs

writeonly

0route.add <destination><mask> <gateway>

1-72

SMS Command Line Interface Reference

Attribute
route.delDescription

Type

Acces
s

Rang
e

Attribute used to delete a static routefrom the IP routing table.Usage:

IPaddrs

writeonly0

Attribute used to list all routes in the
IP routing table.

Stringreadonly0-1024route.del <destination><mask> <gateway>
route.inforoute6
Collection of attribs used to add, delete and display IPv6 static routes for the
management interface.
Usage
route6.add
route6.add <destination> <next hop>route6.del <destination> <next hop>Related objects
route, net

Related commands
ifconfig, ipconfig,

route6 attributes
Attribute
route6.add

Description

Type

Acces
s

Attribute used to add a static routeto the IP routing table.
Usage: route6.add

IPadd
rs

write
only

Range
0

<destination><next hop>

1-73

SMS Command Line Interface Reference

Attribute
route6.delDescription

Type

Acces
s

Range

Attribute used to delete a static
route from the IP routing table.
Usage: route6.del

IPadd
rs

write
only

0

Attribute used to list all routes in the
IP routing table.

Stringreadonly0-1024<destination> <next hop>route6.info

smtp
Used to configure the smtp service.
Collection of SMTP (Simple Mail Transfer Protocol) -related attribs. The
attribs are used to configure the smtp service.
smtp attributes
Attributesmtp.aggregation

Description

Type

AccessAmount of time (in seconds) that
the SMS aggregates the device
email notifications before it sends
the notifications in a single email.

Integerreadwrite

Bool

readwrite

If you set the aggregation to zero(default), the SMS will immediately
disable the email aggregation.
The maximum number of emails
the SMS can collect for a single
aggregation period is 10,000. When
the SMS reaches this limit, it will
discard new device email
notifications received.
This setting only applies to device
notifications. All other SMS emails
are sent immediately.
smtp.secure

1-74

SMTP authentication.

Range

SMS Command Line Interface Reference

Attribute

Description

Type

Accesssmtp.secure-user

SMTP username authentication.

Stringreadwrite

smtp.send-mailSends a mail message from the
SMS. Other SMTP configuration
settings are also required tosuccessfully send mail.

Stringwriteonly

smtp.server

SMTP server.

Stringreadwrite

smtp.notify-list

List of e-mail addresses used todeliver notification messages whena notifiable event occurs. The list
should be one or more e-mailaddresses separated by comma or
semicolons.

Emailreadwrite

Range

snmp
Collection of SNMP (Simple Network Management Procotol) related attribs.
Collection of SNMP (Simple Network Management Procotol) related attribs.
The attribs are used to configure the SNMP trap service and SMS SNMP
request agent.
Related objects
svc

Related commands
snmp-request, snmp-trap

1-75

SMS Command Line Interface Referencesnmp-request attributes
Attribute

Description

Type

Accesssnmp.request-auth-key

Attrib used to specify theauthentication key for the SNMP
request agent. When enabled, the
SMS responds to the SNMP system
request.

StringwriteonlyStringreadwrite

Stringreadwrite

Bool

readwrite

Example:set snmp.request-authkey=mykey
snmp.request-authproto

Attrib used to specify theauthentication protocol for the
SNMP request agent. Whenenabled, the SMS responds to the
SNMP system request.
Valid protocol values are: None,
MD5, and SHA.
Example:set snmp.request-authproto=MD5

snmp.request-community

Attrib used to specify thecommunity string for the SNMP
request agent. When enabled, the
SMS responds to the SNMP system
request.
Example:set snmp.requestcommunity=public

snmp.request-enable

Attrib used to enable/disable the
SMS SNMP request agent. Whenenabled, the SMS responds to
SNMP system requests.
Example:set snmp.requestenable=true

1-76

Rang
e

SMS Command Line Interface Reference

Attributesnmp.request-engine

Description

Type

AccessAttrib used to specify the engine ID
for the SNMP request agent. Whenenabled, the SMS responds to the
SNMP system request.
Example:StringreadwriteStringwriteonlyStringreadwriteRange

set snmp.requestengine=012345
snmp.request-priv-key

Attrib used to specify the privacy
key for the SNMP request agent.
When enabled, the SMS responds
to the SNMP system request.
Example:set snmp.request-privkey=mykey

snmp.request-privproto

Attrib used to specify the privacy
protocol for the SNMP request
agent. When enabled, the SMS
responds to the SNMP system
request. Valid protocol values are:• None• AES-128• AES-192• AES-256• DES• Triple_DES
Example:set snmp.request-privproto=AES-128

1-77

SMS Command Line Interface Reference

Attributesnmp.request-user

Description

Type

AccessAttrib used to specify the username for the SNMP request agent.
When enabled, the SMS responds
to the SNMP system request.
Example:StringreadwriteStringwriteonlyRange

set snmp.requestuser=myuser
snmp.request-version

Attrib used to change the version
for the SNMP request agent. Whenenabled, the SMS responds to the
SNMP system request. Validversion values are: v2 or v3.
Example:set snmp.requestversion=v2

snmp-trap attributes
Attributesnmp.trap-add

Description

Typ
e

Acces
s

Attrib used to add a new SNMP trap
destination. An IP address and SNMP
version uniquely identify a destination.
The IP address must be specified. The
SNMP version is optional and can be
specified when separated by a comma.
Examples:Stringwriteonly

set snmp.trap-add=1.1.1.1
set snmp.trap-add=1.1.1.1,v3

1-78

Ran
ge

SMS Command Line Interface Reference

Attributesnmp.trap-auth-key

Description

Typ
e

Acces
s

Attrib used to specifiy theauthentication protocol for an SNMP
trap destination. The IP address mustbe specified. The SNMP version is
optional and can be specified whenseparated by a comma.
Examples:StringwriteonlyStringreadwrite

StringreadwriteRange

set snmp.trap-auth-key?
1.1.1.1=mkey
set snmp.trap-auth-key?
1.1.1.1,v3= mykey
snmp.trap-auth-proto

Attrib used to specifiy theauthentication key for an SNMP trap
destination. The IP address must be
specified. The SNMP version is optionaland can be specified when separated by
a comma.
Valid protocol values are: None, MD5,and SHA.
Examples:set snmp.trap-auth-proto?
1.1.1.1=MD5
set snmp.trap-auth-proto?
1.1.1.1,v3= MD5

snmp.trap-community

Attrib used to specifiy the community
string for an SNMP trap destination. The
IP address must be specified. The SNMP
version is optional and can be specified
when separated by a comma.
Examples:set snmp.trap-community?
1.1.1.1= public
set snmp.trap-community?
1.1.1.1,v2= public

1-79

SMS Command Line Interface Reference

Attributesnmp.trap-del

Description

Typ
e

Acces
s

Attrib used to remove an SNMP trap
destination. The IP address must be
specified. The SNMP version is optionaland can be specified when separated by
a comma.
Examples:StringwriteonlyStringreadwriteStringreadonlyInt

readwrite

set snmp.trap-del=1.1.1.1
set snmp.trap-del=1.1.1.1,v3
snmp.trap-engine

Attrib used to specify the engine ID for
an SNMP trap destination. The IP
address must be specified. The SNMP
version is optional and can be specified
when separated by a comma.
Examples:set snmp.trap-engine?
1.1.1.1=012345
set snmp.trap-engine?
1.1.1.1,v3= 012345

snmp.trap-info

Attrib used to list the SNMP trap
destination
Example:get snmp.trap-info

snmp.trap-port

Attrib used to specify the port for an
SNMP trap destination. The IP address
must be specified. The SNMP version is
optional and can be specified whenseparated by a comma.
Examples:set snmp.trap-port?1.1.1.1=162
set snmp.trap-port?
1.1.1.1,v2=162

1-80

Ran
ge

SMS Command Line Interface Reference

Attributesnmp.trap-priv-key

Description

Typ
e

Acces
s

Attrib used to specify the privacy key for
an SNMP trap destination. The IP
address must be specified. The SNMP
version is optional and can be specified
when separated by a comma.
Examples:StringwriteonlyStringreadwriteRange

set snmp.trap-priv-key?
1.1.1.1=mkey
set snmp.trap-priv-key?
1.1.1.1,v3= mykey
snmp.trap-priv-proto

Attrib used to specify the privacy
protocol for an SNMP trap destination.
The IP address must be specified. The
SNMP version is optional and can be
specified when separated by a comma.
Valid protocol values are:• None• AES-128• AES-192• AES-256• DES• Triple_DES
Examples:set snmp.trap-priv-proto?
1.1.1.1= AES-128
set snmp.trap-priv-proto?
1.1.1.1,v3= AES-128

1-81

SMS Command Line Interface Reference

Attributesnmp.trap-user

Description

Typ
e

Acces
s

Attrib used to specify the user name for
an SNMP trap destination. The IP
address must be specified. The SNMP
version is optional and can be specified
when separated by a comma.
Examples:StringreadwriteStringwriteonlyRange

set snmp.trap-user?
1.1.1.1=testuser
set snmp.trap-user?1.1.1.1,v3=
testusersnmp.trap-version

Attrib used to change the version for an
SNMP trap destination. The IP address
must be specified. The SNMP version is
optional and can be specified whenseparated by a comma. Valid version
values are: v2 or v3.
Examples:set snmp.trap-version?
1.1.1.1=v3
set snmp.trap-version?
1.1.1.1,v2=v3

svc
Collection of attribs used to enable various services that execute within thesystem. While the system implements an internal firewall to protect against
attacks, further security can be implemented by disabling unneeded
services.
Related commands
ntp, snmp, pwd

1-82SMS Command Line Interface Reference

svc attributes
Attributesvc.fips-enable

Description

Type

AccessRangeAttribute used to enable/disable SMS
FIPS mode. In this mode, only FIPS
140-2 approved cryptographic
algorithms are used when allowing
SSH connections.

Bool

readwrite

0

Bool

readwrite

0

Note
FIPS mode cannot be enabled
if SSH has not been enabled.
Also, disabling SSH
automatically disables FIPS
mode.
Example: set svc.fipsenable=yes

svc.https-enable

Attribute used to enable/disable the
HTTPS (Secure HTTP protocol) service.
The HTTPS service is used to download
the SMS client during the installation
process. The service is configured toprevent CGI and other active server
processing. Once the client isdownloaded, the service can bedisabled until an updated client isavailable.
To enable HTTPS, set the svc.httpsenable attrib to true. To disable, set
to false.

1-83

SMS Command Line Interface Reference

Attribute
svc.ping-enable

Description

Type

AccessRangeAttribute used to enable/disable
incoming ping support. Responding topings can be considered a security
weakness for systems. When disabled,
the SMS will not respond to ICMP Echo
Requests.
Example: set svc.ping-Bool

readwrite

0

Attrib used to enable/disable the NTP(Network Time Protocol) client. The
NTP client can be used to synchronize
system time with a list of remote time
servers.
To enable the NTP client, set the value
to true, and a list of servers should be
provided with the ntp.server1 (...)
attribs. To disable the value should be
set to false.

Bool

readwrite

0

Bool

readwrite

0enable=true
svc.ntp-enable

Example: set svc.ntpenable=true

svc.snmp.requestenable

Attribute used to enable/disable the
SNMP (Simple Network Management
Protocol) agent.
The SNMP service provides limited,
read-only management support to aremote SNMP manager. To enable
SNMP, set the svc.snmp.requestenable attrib to true. To disable, set
to false. The community name for get
requests can be set with thesnmp.get-community attrib.
Example: set svc.snmpenable=true

1-84

SMS Command Line Interface Reference

Attribute
svc.ssh-enable

Description

Type

AccessRangeAttribute used to enable/disable theSSH (Secure Shell) service. The SSH
service is used to provide secured,
remote CLI (Command Line Interface)
access to the system. If SSH is disabled,
the CLI can still be accessed byconnecting a terminal or a keyboard/
monitor to the chassis. The SMS server
supports SSH protocol version 2.
To enable SSH, set the svc.sshenable attrib to true. To disable, set
to false.

Bool

readwrite

0Int

readwrite

30-60
0

Int

readwrite

3-6

Example: set svc.sshenable=true
svc.sshloginGraceTime

Attribute used to set the SSH Login
Grace time.
The Login Grace Time is used to set theamount of time a user has to enter apassword and establish a connection.
The SMS disconnects after this time if
the user has not successfully logged in.
The default is 60 seconds, but you can
set the time from 30 to 600 seconds.
Example: set svc.sshloginGraceTime=60

svc.sshmaxAuthTries

Attribute used to reset the connection
after the max authentication attempts
value has been reached. The default
value is 6. The sshd process will berestarted when this value is changed.
Example: set svc.sshmaxAuthTries=3

1-85

SMS Command Line Interface Reference

Attribute
svc.taxii-enable

Description

Type

AccessRangeAttribute used to enable/disable the
TAXII service. The TAXII service is used
to transfer Structured Threat
Information Expression (STIX™)
Indicator data to the SMS. This data
can be used to detect suspicious or
malicious cyber activity.
Example: set svc.taxii-

Boolreadwrite

0enable=truesw
Collection of software versioning attribs. The attribs are used to report thesystem software version, and to list the software packages and theirindividual versions.
sw attributes
Attribute

Description

Type

AccessRange
0-1024

sw.components

Returns a list of installedsoftware packages and theirversions.

Stringreadonly

sw.hotfix-version

Returns system hotfix version.

Stringreadonlysw.patch-version

Returns system patch version.

Stringreadonly

sw.version

Attribute returning the system
software version.

Stringreadonly

sw.vertica-version

Returns system vertica engine
version.

StringreadonlysysCollection of system-related attribs. The attribs retain system values,
including the system name, location and contact
1-86

1-32

SMS Command Line Interface Reference

sys attributes
Attribute

Description

Type

AccessRange

sys.contact

Attribute holding the system
contact. Normally, this filecontains the name and/or addressof the administrator of this system.

Stringreadwrite

0-64

sys.hypervisor

Attribute holding the system
hypervisor.

Namereadonly

1-32

sys.location

Attribute holding the system
location. Normally, this fieldcontains the physical location of
the system.

Stringreadwrite

0-64

sys.model

Attribute returning the model ofthe SMS. Provide this model ininteractions with support staff.

Stringreadonly

1-32

sys.name

Attribute holding the systemname. The system name must be
set. It will be used in systemprompts.

Name

readwrite

1-32

sys.platform

Attribute returning the platformname. Provide this model number
in interactions with support
professionals.

Stringreadonly

1-32

sys.serialNum

Attribute returning the unique ${PRODUCT} system serial number.

Stringreadonly

20

Provide this serial number ininteractions with support
professionals.

tacacs+Collection of tacacs+-related attribs. The attribs are used to enable andconfigure TACACS+ for the SMS. For information about managing users
including user groups, passwords, and security levels, see the“Administration” chapter in the SMS User Guide.

1-87

SMS Command Line Interface Reference

Tacacs+ attributes
Attribute

Description

Type

Acces
s

Range

tacacs.enable

Attribute used to enable/disable
TACACS+.

Bool

readwrite

tacacs.reset

Attribute used to reset remoteauthentication to local
authentication.

Bool

readwrite

tacacs1.attempts

Attrib used to set the number ofpassword attempts allowed.

Int

readwrite

tacacs1.authmethod

Attrib to set the authentication
method (ASCII, PAP, CHAP,
MS_CHAP)Stringreadwrite

tacacs1.hostname

Attrib used to set the TACACS+
server hostname.

Strin
g

readwrite

tacacs1.port

Attrib used to set the port on the
TACACS+ server that listens forauthentication requests

Int

readwrite

1-65535

tacacs1.secret

Attrib used to enter the TACACS+
secret set by the TACACS+ server
administrator. This entry is usedby each TACACS+ client, including
the SMS server.

Strin
g

readwrite

1-63

tacacs1.server

Attrib used to set the IP address of
the TACACS+ server.

IPadd
r

readwrite

0tacacs1.timeout

Attrib used to set the maximum
timeout period in seconds.

Int

readwrite

1-15

Attrib used to set the number ofpassword attempts allowed.

Int

readwrite

1-10

Primary TACACS+ Server
1-10

Secondary TACACS+ Server
tacacs2.attempts

1-88SMS Command Line Interface Reference

Attribute

Description

Type

Acces
s

Range

tacacs2.authmethod

Attrib to set the authentication
method (ASCII, PAP, CHAP,
MS_CHAP)Stringreadwrite

tacacs2.hostname

Attrib used to set the TACACS+
server hostname.

Strin
g

readwrite

tacacs2.port

Attrib used to set the port on the
TACACS+ server that listens forauthentication requests

Int

readwrite

1-65535

tacacs2.secret

Attrib used to enter the TACACS+
secret set by the TACACS+ server
administrator. This entry is usedby each TACACS+ client, including
the SMS server.

Strin
g

readwrite

1-63

tacacs2.server

Attrib used to set the IP address of
the TACACS+ server.

IPadd
r

readwrite

0tacacs2.timeout

Attrib used to set the maximum
timeout period in seconds.

Int

readwrite

1-15

tacacs3.attempts

Attrib used to set the number ofpassword attempts allowed.

Int

readwrite

1-10

tacacs3.authmethod

Attrib to set the authentication
method (ASCII, PAP, CHAP,
MS_CHAP)Stringreadwrite

tacacs3.hostname

Attrib used to set the TACACS+
server hostname.

Strin
g

readwrite

tacacs3.port

Attrib used to set the port on the
TACACS+ server that listens forauthentication requests

Int

readwrite

Tertiary TACACS+ Server

1-65535

1-89

SMS Command Line Interface Reference

Attribute

Description

Type

Acces
s

Range

tacacs3.secret

Attrib used to enter the TACACS+
secret set by the TACACS+ server
administrator. This entry is usedby each TACACS+ client, including
the SMS server.

Strin
g

readwrite

1-63

tacacs3.server

Attrib used to set the IP address of
the TACACS+ server.

IPadd
r

readwrite

0tacacs3.timeout

Attrib used to set the maximum
timeout period in seconds.

Int

readwrite

1-15

time
Collection of system time attribs. The attribs are used to configure the local
time zone and the current system time.
See also
ntp

time attributes
Description

Type

Acces
s

Rang
e

time.dateTime

Displays the current system time in areadable format.

Strin
g

readonly

32

time.hhmmss

Displays the current hours, minutes,
and seconds in a readable format.

Strin
g

readwrite

time.setTime

Displays and sets the current systemtime. The date and time is specified in
the format: [MMDDhhmm[[CC]YY][.ss]]

Strin
g

readwrite

Attribute

1-90

32

SMS Command Line Interface Reference

Attributetime.setTimeZone

Description

Type

Acces
s

Rang
e

Displays and sets the current local
time zone. Time zones can be
represented in several forms. For
example, US Eastern Time can be
represented as either of the following:

Strin
g

readwrite

2-48

Strin
g

readwrite• EST5EDT• America/Newark
The first format is the preferred
format: a three-letter zone, followed
by a time offset from GMT, and anotherthree-letter zone for the daylightsavings time.
Examples:set time.setTimeZone=
America/New_York set
time.setTimeZone=CST6CDT
time.yyymmdd

Displays the year, month, and day in areadable format..

1-91

Item Code: TPEM69845/230927