000016781 - RSA NetWitness Investigator 6.0.0.x and 6.1 is dropping packets

Document created by RSA Customer Support Employee on Jun 15, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000016781
Applies ToRSA NetWitness NextGen
RSA NetWitness Investigator
RSA NetWitness Investigator 6.0.0.x
RSA NetWitness Investigator 6.1
IssueRSA NetWitness Investigator 6.0.0.x and 6.1 is dropping packets.
CauseWithout the use of an accelerated sniffer card, NetWitness uses winpcap and the onboard NIC for acquisition. In most enterprises this is adequate to support collections sustained above 125Mb/s, peaking above 250Mb/s.
ResolutionIn order to resolve the issue, some configurations may need to be tweaked. Use the Performance Wizard and pay special attention to the winpcap kernal memory.

plugin.winpcap.memory =
Bytes of kernel memory allocated for WinPCap. Default is 10MB. Increasing this setting improves sniffer performance(30MB), but may also cause the windows kernel to become unstable.
Legacy Article IDa58542

Attachments

    Outcomes