---
title: "Netprobe Command-line Options"
description: ""
url: "https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/configuration/netprobe-command-line-options/index.html"
---
## Overview

Command-line options can either be passed to the Netprobe installer on Windows, or directly to the Netprobe binary.

## Installer command-line options

The installer command line options are available only to Windows platforms.

| Option | Use |
|-------|-------|
| `/netport=<listen port>` | Sets the Netprobe listening port. Default: `7036` |
| `/servicename=<servicename>` | Sets the Netprobe service name. Default: `NetprobeNT` |
| `/nopassword` | Allows commands to run on the Netprobe without any prompting for a password. For more information, see [Set passwords on Netprobe commands](https://docs.itrsgroup.com/docs/geneos/7.11.0/security/access-controls/set-passwords-on-netprobe-commands/index.html). |
| `/pass=<password>` | Sets a Netprobe password. 
**Note**

 The `/nopassword` option will override this option but `ENCODED_PASSWORD` will still be set in the registry. 
 |
| `/listenip` | Sets a specific IP address where the Netprobe will listen to incoming connections. This argument can be used to force Self-Announcing Netprobe not to listen for incoming connections. For more information, see [Disable listening in Manage Self-Announcing Netprobes](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/configuration/manage-self-announcing-netprobes/index.html#disable-listening). |
| `/listenoverride` | Used in conjunction with `/listenip`, overrides the previous value of `/listenip` if it exists. |
| `/discovery=<full path to file>` | Used in conjunction with `/setup`. If `/setup` is not defined, then this option is ignored.
If invoked, the Netprobe runs a discovery executable on the machine it is running on. This executable extracts JSON metadata from its environment, and updates the Netprobe setup file with the metadata through the use of macros.
If you specify a setup URL with the `?` character, then the Netprobe appends the JSON metadata as query parameters and pulls the setup file from the URL specified.
When present, the discovery executable runs at Netprobe startup, before the Netprobe reads any setup file, and before it connects to any Gateway.
For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery).
Mandatory: No |
| `/setup=<full path or URL to file>` | Sets the setup file for a self-announcing or floating Netprobe. By default, the full path is `<directory of installer>\\setup.netprobe.xml`.
If you use the default setup file, then this will be copied into the installation directory (for example, C:\\Program Files (x86)\\NetprobeNT). This new path then becomes the value of the -setup argument of the Netprobe imagePath registry.
If you specify your own setup file, the file will be used in its respective directory. It will not be copied into the installation directory.
If you specify a remote file (`<url>`), the Netprobe saves a copy of this in the installation directory as `netprobe.setup.xml`. This overwrites the existing `netprobe.setup.xml` file in the installation directory. In this case, any local changes to the `netprobe.setup.xml` configuration are ignored as the Netprobe retrieves the configuration from the remote file every `/setup-interval=<minutes>`.
If you specify an invalid file from the `<url>`, or the `<url>` becomes inaccessible, then the Netprobe uses the existing `netprobe.setup.xml` file.
**Auto-discovery**
When used with `/discovery`, the Netprobe setup file generates its contents from JSON metadata pulled from its environment by the discovery script.
If you specify a setup URL with the `?` character, then the Netprobe appends the JSON metadata as query parameters and pulls the setup file from the URL specified. For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery). 
**Note**

`/setup=<url>` only supports HTTP links by default. If you need to set up an HTTPS connection, see the `/setup-server-verify` option. When using /setup=<url> with multiple instances of the Netprobe, check that you install each probe in its own directory. Otherwise, the setup for each probe may interfere with one another. Do not use proxy servers for `/setup=<url>`. Proxy servers are not supported. 
 |
| `/setup-interval=<minutes>` | Used in conjunction with `/setup`.
Defines the time interval before the floating or Self-Announcing Netprobe requests another configuration file and restarts the announcement process. If no new or valid file is discovered, then the Netprobe neither reloads the configuration file nor restarts the configuration process.
If no `-setup-interval` is defined, the Netprobe makes the request every 360 minutes (or 6 hours), by default.
**Feature behavior**
By default, this option only works for remote configurations defined through `/setup=<url>`. However, if used in conjunction with `/discovery`, then this option works for both `/setup=<filename>` and `<url>`.
**Auto behavior**
When used with `/discovery`, then this option defines the time interval before the Netprobe reruns the discovery executable to update the JSON metadata. If no updates are discovered from the extracted JSON metadata, then the Netprobe does not reload the Netprobe setup file. For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery). |
| `/setup-server-verify=<file>` | Used in conjunction with `/setup=<url>`. This option only takes effect when an HTTPS `<url>` is specified. Otherwise, this option is ignored.
When this option is invoked, the Netprobe verifies the remote server against the specified Certificate Authority (CA) bundle. |
| `/secure` | Used to enable secure mode during installation. |
| `/ssl-certificate=<full path to file>` | Used in conjunction with `/secure`; sets the SSL certificate file which is used to allow the probe to run in secure mode (when accepting incoming connections) Default: `<directory of installer>\\cert.netprobe.pem`
If the default SSL certificate file is not used, then the file specified will be used in situ. It will not be copied into the installation destination.
If the default SSL certificate file is used then it will be copied to the installation destination (for example, `C:\\Program Files (x86)\\NetprobeNT`) and this new path will be set as the value of `-ssl-certificate` argument of Netprobe's imagePath in registry.  |
| `/ssl-certificate-chain=<filename>` | Used in conjunction with `/secure`; sets the SSL certificate chain file used by the Netprobe to check the certificate of the Gateway when a connection is made. Default: `*<directory of installer>\\cert-chain.netprobe.pem*`
If the default SSL certificate chain file is not used, then the file specified will be used in situ. It will not be copied into the installation destination. If the default SSL certificate chain file is used then it will be copied to the installation destination (for example, `C:\\Program Files (x86)\\NetprobeNT`) and this new path will be set as the value of `*-ssl-certificate-chain*` argument of Netprobe's imagePath in registry.  |
| `/ssl-certificate-key=<path to key file>` | Used in conjunction with `/secure`; used to explicitly define the signed SSL server private key in PEM format.
If this option is not specified, but the certificate is, the Netprobe will look for the private key in the same file as the server certificate. |
| `/dir=<install dir>` | Sets the Netprobe installation path. |
| `/log=<filename>` | Sets the Netprobe log filename. |
| `/silent` | Runs the install with no user interaction, but you can see the installation progress. |
| `/verysilent` | Does the same as `/silent` but it does not show the installer files being extracted. |
| `/require-ssl-certificate-for` | This forces the Netprobe to require certain components connecting to the Netprobe port to provide a valid SSL certificate. If no certificate is provided or the certificate cannot be vaildated using the certificate authority provided by the `-ssl-certificate-chain` option, the connection will be rejected. Currently, this does not require any additional parameter as only the connection type EMF2 is supported. |
| `/minTLSversion=<version>` | Specifies the minimum TLS version. The accepted values are the following: - 1
- 1.0
- 1.1
- 1.2
- 1.3 For more information, see [TLS versions in Secure Communications](https://docs.itrsgroup.com/docs/geneos/7.11.0/security/secure-communications/ssl_ug/index.html#minimum-tls-versions). |
| `/cmdargs` | Defines additional [command-line arguments](#binary-command-line-options) to be passed to the Netprobe at startup. |

### Set up a self-announcing or floating Netprobe

To set up a Self-Announcing or Floating Netprobe from the installer wizard, check the **Install as Self-Announcing or Floating Netprobe** checkbox from the **Configure Self-Announcing or Floating Netprobe** screen. Select a configuration file from that screen.

You can also specify the Self-Announcing or Floating Netprobe configuration file through installer command-line switch. To do this, start a new Administrator command-line window and run `geneos-netprobe-<version>.windows-<platform>.setup.exe.windows-x64.setup.exe /setup=<setup_xml_filename >`, where <setup_xml_filename> specifies the full path to the Self-Announcing or Floating Netprobe configuration file:

```
geneos-netprobe-*<version>*.windows-<platform>.setup.exe
```

### Set up a secure Netprobe

To setup a secure Netprobe from the installer wizard, check the **Run probe in Secure Mode** checkbox from the **Configure Netprobe Secure Connections** screen. You can:

- Select a PEM file that contains both the secure key and the secure certificate that the probe will use. This can also be done on the command line by using the `/ssl-certificate` flag; the flag followed by the name of the PEM file to use.
- Select distinct files for the SSL server certificate (.pem file) and the signed SSL server private key (.key file) by using the `/ssl-certificate-key=<path_to_key_file>` option.

The certificate chain that is used to verify the certificates presented to the Netprobe can also be set either by using the wizard and setting the file on the **Configure Netprobe Secure Chain** page, or by using the /ssl-certificate-chain command flag. In both cases, a file containing the certificates with which the presented certificates have been signed must be provided.

If you're doing a silent mode install using either `/silent` or `/verysilent` option, then:

- The `/setup= switch` should be used if a the probe is to run as a Self-Announcing or Floating Netprobe.
- The `/ssl-certificate= flag` should be used if the Netprobe is to run in a secure mode and only accept secure (TLS) connections from the Gateway.
- The `/ssl-certificate-chain= switch` should be used if the Netprobe is to validate the Gateway certificates prior to allowing the Gateway to connect to the probe.


**Error**

  
If any of the files specified do not exist, the installer will fail silently and an 'Install Failed' line will be logged in the setup log. You can specify the log file with the /log=<log file> switch in the installer.




**Success**

  
On completion, the Netprobe will have been installed and started running as a service. The relevant registry settings will also have been set up.




**Note**

  
If the Windows Win Apps Plug-in is to be run on a Windows 2008 Server, then it is necessary to alter the properties of the service to "Allow service to interact with desktop". For more information, see [Windows Win Apps Plugin](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/windows-apps/index.html).



## Binary command-line options

The binary command-line options are applicable to all platforms, unless otherwise stated.

On Windows, you can define these options as additional parameters to be passed to the Netprobe command line through the [Netprobe installer](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/installation/quickstart-windows/index.html#installer).

| Binary command line option | Description |
|-------|-------|
| `-help` | Displays a list of command line options and exits. |
| `-version`
`-ver`
`-v` | Displays version information and exits. |
| `port` | Sets the listening port for the Gateway connection. |
| `-connectionRetries <count>` | Enables connection retries when the Netprobe listening port is in use at startup. Sets the number of times the Netprobe retries binding to the port. If the port cannot be bound after all retries are exhausted, the Netprobe exits. |
| `-nolog` | Ignores any setting from the `LOG_FILENAME` variable and logs to the terminal instead. |
| `-extract <key> <filename>` | Extracts data embedded in the binary, writing it to the `<filename>` specified.There are two supported values for `<key>`: - `schema` — extracts the Gateway Setup File schema embedded in the Netprobe binary.
- `npschema` — extracts the Netprobe Setup File schema embedded in the Netprobe binary. |
| `-noschema` | If invoked, the Netprobe does not publish the schema to the Gateway. |
| `-discovery <file path>` | Used in conjunction with `-setup`. If `-setup` is not defined, then this option is ignored.
If invoked, the Netprobe runs a discovery executable on the machine it is running on. This executable extracts JSON metadata from its environment, and updates the Netprobe setup file with the metadata through the use of macros.
If you specify a setup URL with the `?` character, then the Netprobe appends the JSON metadata as query parameters and pulls the setup file from the URL specified. When present, the discovery executable runs at Netprobe startup, before the Netprobe reads any setup file, and before it connects to any Gateway.
For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery).
Mandatory: No |
| `-setup`
`-setup <filename>`
`-setup <url>` | Used when running the Netprobe in Floating or Self-Announcing mode. Specifies the Netprobe Setup File to use.
The Netprobe Setup File can be specified as a local file (`<filename>`) or a remote file (`<url>`).
If no `<filename>` or `<url>` is specified, then the Netprobe defaults to the `netprobe.setup.xml` file in the current working directory. The Netprobe Setup File needs to specify the connection details of one or more Gateways.
If you specify a remote file (`<url>`), the Netprobe saves a copy of this in the current working directory as `netprobe.setup.xml`. This overwrites the default Netprobe configuration. In this case, any local changes to the `netprobe.setup.xml` configuration are ignored as the Netprobe retrieves the configuration from the remote file every `-setup-interval <minutes>`.
If you specify an invalid file from the `<url>`, or the `<url>` becomes inaccessible, then the Netprobe uses the default configuration.
**Auto-discovery**
When used with `-discovery`, the Netprobe setup file generates its contents from JSON metadata pulled from its environment by the discovery script.
If you specify a setup URL with the `?` character, then the Netprobe appends the JSON metadata as query parameters and pulls the setup file from the URL specified.
For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery). 
**Note**

`-setup <url>` only supports HTTP links by default. If you need to set up an HTTPS connection, see the `-setup-server-verify` option. When using `-setup <url>` with multiple instances of the Netprobe, check that you run each probe in its own directory. Otherwise, the setup for each probe may interfere with one another. Do not use proxy servers for `-setup <url>`. Proxy servers are not supported. The `-setup <url>` option is not supported for IBM AIX platforms. 
 |
| `-setup-interval <minutes>` | Used in conjunction with `-setup`.
Defines the time interval before the floating or Self-Announcing Netprobe requests another configuration file and restarts the announcement process. If no new or valid file is discovered, then the Netprobe neither reloads the configuration file nor restarts the configuration process.
If no `-setup-interval` is defined, the Netprobe makes the request every 360 minutes (or 6 hours), by default.
**Feature behavior**
By default, this option only works for remote configurations defined through `-setup <url>`. However, if used in conjunction with `-discovery`, then this option works for both `-setup <filename>` and `<url>`.
**Auto-discovery**
When used with `-discovery`, then this option defines the time interval before the Netprobe reruns the discovery executable to update the JSON metadata. If no updates are discovered from the extracted JSON metadata, then the Netprobe does not reload the Netprobe setup file.
For more information, see [Auto-discovery in Netprobe Overview](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/introduction/netprobe-overview/index.html#auto-discovery). 
**Note**

For IBM AIX platforms, this option works when used in conjunction with `-discovery` and `-setup <file path>`. 
 |
| `-setup-server-verify <file>` | Used in conjunction with `-setup <url>`. This option only takes effect when an HTTPS `<url>` is specified. Otherwise, this option is ignored.
When this option is invoked, the Netprobe verifies the remote server on the `-setup <url>` against the specified Certificate Authority (CA) bundle.
You can specify a CA bundle on the `<file>` argument in PEM format.
If no `<file>` is specified, then the Netprobe verifies the remote server against the operating system's Certificate Authority (CA) bundle. In this case, the required certificates must be installed in the appropriate certificate stores. 
**Note**



- On Windows, the `<file>` argument is required.
- On Linux in Geneos 7.2.0 and earlier versions, the Netprobe searches for the default CA bundle at `/etc/pki/tls/certs/ca-bundle.crt`. However, in Ubuntu and SLES platforms, the default CA bundle is not located at this path. For these platforms, you can either specify a CA bundle file for this option or create a symbolic link at `/etc/pki/tls/certs/ca-bundle.crt` to the platform's default CA bundle.
 - For Ubuntu: The default CA bundle is at `/etc/ssl/certs/ca-certificates.crt`.
 - For SLES: The default CA bundle is at `/var/lib/ca-certificates/ca-bundle.pem`.
- On IBM AIX, this option is not supported. 
 |
| `-mdmtest <lua_script> [params]` | Test utility for Market Data Monitor Lua script prior to deployment.
Example: `$./netprobe.linux-mdmtesttest.luaparam1param2` |
| `-listenip` | Sets a specific IP address where the Netprobe will listen to incoming connections.
This argument can be used to force Self-Announcing Netprobes not to listen for incoming connections. For more information, see [Disable listening in Manage Self-Announcing Netprobes](https://docs.itrsgroup.com/docs/geneos/7.11.0/collection/netprobe/configuration/manage-self-announcing-netprobes/index.html#disable-listening). |
| `-logMaskingRules <path>` | Specifies a YAML or JSON file that defines [log masking](https://docs.itrsgroup.com/docs/geneos/7.11.0/administration/log-masking/index.html) rules applied to Netprobe log lines before they are written. A starter template is packaged as `templates/log-masking-rules.yaml`. 
**Note**

 If you use the Windows Netprobe installer, enclose the file path in double quotes. For example `-logMaskingRules "C:\Program Files (x86)\NetprobeNT\templates\log-masking-rules.yaml"`. 
 When this option loads successfully, the Netprobe also passes `-Dgeneos.logMasking.rules` with the same path to the embedded JVM for Java plugins, unless that property is already set in `JPROPERTIES`. |
| `-ssl-certificate` | This is the file that contains the signed SSL server certificate in PEM format. |
| `-ssl-certificate-key` | This is the file that contains the signed SSL server private key in PEM format.
If this is option not specified, but the certificate is, then the Netprobe will look for the private key in the same file as the server certificate. |
| `-ssl-certificate-chain` | This is the file that contains the trusted certificate authority. |
| `-require-ssl-certificate-for` | This forces the Netprobe to require certain components connecting to the Netprobe port to provide a valid SSL certificate.
If no certificate is provided, or the certificate cannot be vaildated using the certificate authority provided by the `-ssl-certificate-chain` option, the connection will be rejected. The connection type of the connections to check must be provided.
This command line option only supports the `emf2` argument, which covers all Geneos components connecting using the Geneos EMF2 protocol. |
| `-secure` | If this option is present, the Netprobe will listen on a secure port rather than an insecure port.
If `-secure` is specified, then an SSL server certificate and an server private key also need to be specified. |
| `-nopassword` | Run commands on the Netprobe's host. For more information, see [Set passwords on Netprobe commands](https://docs.itrsgroup.com/docs/geneos/7.11.0/security/access-controls/set-passwords-on-netprobe-commands/index.html) |
| `-mq QM=<qm_name> MQSERVER=<conn_string> CHANTAB=<chan_table> KEYREPO=<ssl_keyrepo> CIPHER=<cipher_spec>` | Test MQ connection. - QM — queue manager, e.g. qm.test
- MQSERVER — server connection string, e.g. CHAN/TCP/host(port)
- CHANTAB — full path to the channel table file, e.g. /var/mqm/AMQCLCHL.TAB
- KEYREPO — full path to SSL key repository, e.g. /var/mqm/ssl/key(.kdb)
- CIPHER — SSL cipher specification, e.g.TRIPLE_DES_SHA_US Example value: `netprobe-mqQM=qm.testMQSERVER=CHAN/TCP/host` |
| `-minTLSversion <version>` | Specifies the minimum TLS version. The accepted values are: - `1`
- `1.0`
- `1.1`
- `1.2`
- `1.3` For more information, see [Secure Communications](https://docs.itrsgroup.com/docs/geneos/7.11.0/security/secure-communications/ssl_ug/index.html). |
| `-openssl-cipher <ciphers>` | To set the available TLS ciphers use the `-openssl-cipher` command line option, replacing `` with a comma separated list of ciphers.
For more information, see [TLS ciphers in Secure Communications](https://docs.itrsgroup.com/docs/geneos/7.11.0/security/secure-communications/ssl_ug/index.html#tls-ciphers). |
| `-json2XML <filename>` | Converts JSON document specified by `<filename>` to XML and displays result to the console. This is applicable to Windows platforms only. |
| `-jvm-libpath <path>` | Specifies `<path>` of the JVM library to use.
If this option is invoked, the Netprobe does not attempt to locate the library in the `PATH` or `LD_LIBRARY_PATH` environment variable. In Windows, the `JVM_LIBPATH` registry key is ignored.
Example value: `-jvm-libpath /usr/java/jdk/jre/lib/amd64/server/libjvm.so` |
| `-java-home <path>` | Specifies the `<path>` of the JRE to use. Overrides the `JAVA_HOME` environment variable. |
| `-perf` | Show available performance monitor counters. This is applicable to Windows platforms only. |
| `-cmd` | Run in the foreground, rather than as a service. This is applicable to Windows platforms only. |
| `-install` | Installs the probe as a service. This is applicable to Windows platforms only. |
| `-uninstall`| Uninstalls the probe as a service. This is applicable to Windows platforms only. |
| `-showcpus` | Shows detected CPU information for this machine. This is applicable to Windows platforms only. |
| `-disable-core-dump` | Disables creation of core dump files. This is applicable to Windows platforms only. |
| `-ifconfig`, `-if` | Lists down the NICs present in the Windows machine. This should be used in configuring X-plugins send / recv interfaces. This is applicable to Windows platforms only. 
**Note**

 The Npcap packet capture library needs to be installed on the host. If Npcap is not installed using WinPcap API-compatible mode, then the Npcap installation directory must be added in the `PATH` environment variable or the `DLL_PATH` registry variable. 
 |
| `-perfdebug` | Dumps performance counter data into a file (i.e., `perfout.dat`). This is applicable to Windows platforms only. |
| `-json2XML <filename>` | Converts JSON document specified by `<filename>` to XML and displays result to the console. This is applicable to Windows platforms only. |