000014873 - Error message 'The session's packets no longer exist. No content can be displayed' in RSA NetWitness Investigator

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000014873
Applies ToRSA NetWitness NextGen
RSA NetWitness NextGen 8.6
RSA NetWitness Decoder
RSA NetWitness Investigator
IssueError message "The session's packets no longer exist. No content can be displayed" in RSA NetWitness Investigator.
When using RSA NetWitness Investigator to drill into a session you receive the following message:  The session's packets no longer exist. No content can be displayed
Resolution

To verify the oldest data available do the following:

 

SSH into the decoder and navigate to /home/NetWitness/decoder/PacketDB 

 

Issue the following command:  ls -la | grep packet -m 1

 

Sample output -
-rw-rw-r--  1 root   root       10737435107 2009-10-22 12:21 packet-000008752.nwpdb

 

The output above indicates that the oldest packet data available is from October 22 at 12:21pm, therefore you will not be able to retrieve any sessions prior to that date.

Legacy Article IDa58583

Attachments

    Outcomes