Architecture overview - User Guide - LiveWire - 26.2.0

LiveWire User Guide
ft:locale
en-US
Product name
LiveWire
Version
26.2.0

The Remote Capture Engine (RCE) architecture consists of three tightly integrated components that work together to provide secure, centrally managed packet capture for Windows and Linux environments:

  • RCE endpoint agents installed on Windows or Linux devices
  • LiveWire, the centralized control point
  • Floating License Server, running standalone or co-located with LiveWire

Analysis cannot be done on the RCE. The capture files need to be transferred from the RCE to the LiveWire for analysis.

Important: Each RCE must maintain active, secure connections to both LiveWire and the License Server to operate.


Remote Capture Engine (RCE) — Windows or Linux Endpoint Agent

The RCE is a lightweight service. For Windows machines, this service is deployed through Enterprise Software Distribution (ESD) or Mobile Device Management (MDM) tools such as SCCM, Intune, JAMF, or any MSI-capable platform. For Linux machines, this service is deployed through a Docker container.

After installation, the RCE performs two essential functions:
  1. Call-Home to LiveWire & Heartbeat
    • Authenticates using the Authentication Group Secret
    • Sends regular heartbeats confirming the RCE is online and ready for capture
    Note: LiveWire displays the last time that a heartbeat was received.
  2. License Checkout
    • Initiates a session with the Floating License Server
    • Checks out a license from the pool
    • Must maintain a continuous license session

    If the session drops, the RCE becomes unlicensed and cannot capture.

    When both connections are active, the RCE is fully enabled for remote capture.

LiveWire Control Point

LiveWire orchestrates all RCE endpoints. After an RCE calls home:

  • It appears as an available capture engine in the engine view
  • Administrators can:
    • Configure capture filters
    • Start and stop captures
    • Retrieve and analyze PCAPs

LiveWire handles command and control; RCE performs execution on the endpoint.

Floating License Server — Authorization Component

The Floating License Server ensures that only authorized endpoints can perform packet captures. It can run standalone or be co-located with LiveWire. Co-location is most common and simplifies network configuration because RCE endpoints use a single IP/hostname for both control and licensing.

License Enforcement

  • Each RCE checks out a license at startup
  • The license session must remain active
  • If the session drops, the endpoint becomes unlicensed immediately
  • License pools (e.g., 50-license pool or full site license) are enforced in real time

    This ensures only authorized RCE agents remain operational.