What is the Max Capture Rate of an RSA NetWitness decoder appliance?

Issue

What is the Max Capture Rate of an RSA NetWitness decoder appliance?

Resolution

9.5 Software:  1 Gbps maximum on all appliances

9.6/9.7 Software on Series 3:  2 Gbps maximum, subject to content and environmental considerations

9.6/9.7 Software on Series 4:  Series 4 appliances are scoped for 2 Gbps. but peaks have been observed in excess thereof; subject to content and environmental considerations. 

Note:  These rates are for the combined/aggregate capture rate of all capture interfaces; they are NOT per-interface.  Examples of content and environmental considerations are number and types of enabled parsers, the size and number of sessions captured, and protocol profile of captured traffic. 


Performance Rules of Thumb:

1. High Traffic Rate + Large Number of Small Sessions = More load on Decoder and Concentrator(s) due to more entries in session DB, meta DB, and index
2. High Traffic Rate + Fewer Number of Larger Sessions = Lighter load on Decoder and Concentrator due to fewer entries in session DB, meta DB, and index.
3. More enabled parsers = more meta generated = more entries in meta DB and index = greater potential for negatively impacting Concentrator performance.  In high traffic environments, use only those parsers that are genuinely required for traffic analysis.

Internal Comments

UserName:shurtj
5/29/2014 9:10:55 PM - Modified Statements
Modified statements to adhere to Primus best practices.

Product Details

RSA NetWitness NextGen
RSA NetWitness Decoder
RSA NetWitness Hybrid