1
Unbox and inspect the appliance
Remove the LARK from its packaging and inspect the chassis for shipping damage. Locate the delivery record included with the unit — you will need it for the appliance’s default hostname, IP address, and model-specific interface details throughout this process.
2
Identify your interfaces
Before cabling, review the Port References page to confirm the role of each physical interface on your unit. Key ports are the rear connectivity interface (RJ45) for network access and the rear ingress port (typically SFP+ fiber) for traffic input.
3
Connect power and network
Connect the appliance to a power source — ideally through a UPS. Then connect the rear connectivity interface to your local switch using an RJ45 cable. See Recommended Configuration for guidance on using a switch rather than a direct laptop connection.
4
Connect the traffic source
Connect your TAP or SPAN port output to the ingress port on the rear of the appliance. Confirm the media type (fiber SFP+ in most configurations) matches your TAP or switch output. Refer to Port References for ingress port details.
5
Power on and wait for boot
Apply power. Allow the appliance sufficient time to complete its boot sequence. Boot time varies by model — consult the delivery record if you are unsure of the expected startup duration.
6
Locate the appliance on the network
Using the default hostname or IP address from your delivery record, confirm the appliance is reachable from an analyst laptop on the same network segment. Refer to Naming & Addressing for the default subnet layout and hostname conventions.
If you cannot reach the appliance at its default address, verify that your laptop is on the same subnet and that the correct connectivity port is cabled to the switch.
7
Log in and change default credentials
Open a browser and navigate to
https://<appliance-address>/ to reach the main dashboard. Log in with the default credentials from the delivery record. Immediately navigate to https://<appliance-address>/auth/admin to change the default admin password. See Application URLs for a full list of interface addresses.8
Verify traffic ingress
Navigate to
https://<appliance-address>/packets or https://<appliance-address>/flows to confirm that the appliance is receiving and processing traffic from your TAP or SPAN source. If no traffic appears, check the ingress cabling and TAP configuration.9
Open the analyst views
With traffic confirmed, open the remaining analyst interfaces as needed:
- IDS Alerts —
https://<appliance-address>/alerts - File Analysis —
https://<appliance-address>/files - AI Assistant —
https://<appliance-address>/ai