000012639 - RSA NetWitness Investigator sessions are being disconnected

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012639
Applies ToRSA NetWitness NextGen
RSA NetWitness NextGen 9.5 and above
RSA NetWitness Investigator
IssueRSA NetWitness Investigator sessions are being disconnected.
Investigator sessions from a Broker/Concentrator get disconnected after a certain period of time.
ResolutionRSA NetWitness Investigator does not transmit data over the socket periodically unless the application is actively being used.  This makes the connection appear to be idle by some firewalls and they will forcibly timeout and close the connection.  NextGen has no mechanism to force a session timeout or logoff after a given period of time.

To test whether it is s a firewall timing out the connection, using Administrator, connect to the same appliance that you're connecting to with Investigator.  Does it disconnect after the same duration that Investigator disconnects?  Administrator is constantly transmitting packets, therefore the socket will not be idle, even if left overnight.  If Administrator does not disconnect, this indicates a firewall is timing out your Investigator sessions.
Legacy Article IDa58891