Article Content
Article Number | 000035361 |
Applies To | RSA Product Set: Security Analytics RSA Product/Service Type: Security Analytics Server, Ultra DAC RSA Version/Condition: 10.6 |
Issue | In an environment with a Series 5 10G Ddecoder and 1 ultra DAC, consistent packet drops may occur at high bursts of 7-10g capture. |
Cause | When DACs do not have enough throughput to sustain the capture speed, this log message can be seen on the 10G Decoder in the /var/log/messages file as shown below.
|
Resolution | With 10G capture it is recommended to invest in 2 DACs. With one Ultra DAC and 2 SAS connections, adjust the following configuration for 10G capture to hold more packets in memory during the time of high capture bursts: /decoder/config/pool.packet.pages=1100000 /decoder/config/capture.buffer.size=512MB /database/config/meta.integrity.flush=normal /database/config/session.integrity.flush=normal /database/config/packet.integrity.flush=normal |