|Applies To||RSA Product Set: RSA NetWitness Platform|
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.3, 11.4, 11.5
|Issue||Concentrator's behind number increases rapidly when Decoder's capture rate is 3~5 Gbps.|
User cannot investigate recent data.
|Cause||Low bandwidth between decoder and concentrator causes this problem.|
'ethtool <interface>' command displays the speed is configured as 100 Mb/s which is 12.5 MB/s. (Convert bit/sec to byte/sec). 100Mb/s of speed is low for connectivity between decoder and concentrator.
Below message occur at /var/log/messages.
The result of 'netspeed' command also displays very low (about 5~10 MB/sec).
|Resolution||The network administrator should change their network connectivity(switch or hub) between the decoder and concentrator from 100baseT/Full to 1000 or 10000baseT/Full.|
After changing the connectivity to 1000baseT/Full, netspeed results around 80~90MB/sec.
The behind count starts to decrease after the network change.