When a packet decoder with a 10G NIC capture interface starts to receive no packets due to shutting down the TAP/Switch port or removing the network cable, the decoder's stat still shows the previous capture rate instead of displaying the current capture rate of 0.
This issue is due to the way the pfring API was designed (part of the 10G card driver API). If there are no packets coming in, the capture thread will block so the capture rate will stay the same.
This issue should be resolved in Version 11.X of RSA NetWitness. Please update to this release to take advantage of this fix.
If you are unable to update at this time, the present workaround for the issue is to monitor /database/stats/packet.rate instead of /decoder/stats/capture.rate.