question on network reconstruction
Guys, i'm having this issue, already opened case with support but no reply.
1. Not sure 10.3 SP2 changed the behavior, due to default setting: assembler.size.max which is 32 MB, the session bigger than 100MB is split.
2. If set this setting to 0 MB, we can see the session’s original size in SA UI.
3. In 10.2.2, the SA UI will reconstruct the sessions to display its original size.
The purpose is to track session size bigger than 100MB.
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform