000038865 - How to check Network bandwidth in RSA NetWitness Platform between ESA/Correlation server and Data Source concentrators

Document created by RSA Customer Support Employee on May 22, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038865
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7
IssueNetwork bandwidth is one of the key factors for aggregation performance. 
ResolutionPlease use below steps check Network bandwidth between ESA/Correlation server and Concentrator.
  1. On Concentrator, Run below command to listen on port 64000 port. Keep command running.
    nc -lk 64000 >/dev/null
  2. On ESA/Correlation server, Run below command to send traffic 100MB with zero values.
    dd if=/dev/zero bs=10000 count=10000 | nc -v <ConcentratorIP> 64000

    This would give Network bandwidth between Servers.
Sample output:

[root@ESA ~]# dd if=/dev/zero bs=10000 count=10000 | nc -v 64000
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to
10000+0 records in
10000+0 records out
100000000 bytes (100 MB) copied, 1.02316 s, 97.7 MB/s
Ncat: 100000000 bytes sent, 0 bytes received in 0.86 seconds.

Note: It is always recommended 100 MB/s speed for efficient aggregation performance.