|Applies To||RSA NetWitness NextGen|
RSA NetWitness NextGen 9.5 and above
RSA NetWitness Investigator
|Issue||RSA NetWitness Investigator sessions are being disconnected.|
Investigator sessions from a Broker/Concentrator get disconnected after a certain period of time.
|Resolution||RSA NetWitness Investigator does not transmit data over the socket periodically unless the application is actively being used. This makes the connection appear to be idle by some firewalls and they will forcibly timeout and close the connection. NextGen has no mechanism to force a session timeout or logoff after a given period of time.|
To test whether it is s a firewall timing out the connection, using Administrator, connect to the same appliance that you're connecting to with Investigator. Does it disconnect after the same duration that Investigator disconnects? Administrator is constantly transmitting packets, therefore the socket will not be idle, even if left overnight. If Administrator does not disconnect, this indicates a firewall is timing out your Investigator sessions.
|Legacy Article ID||a58891|