How to configure the MTU size within the NetWitness Platform

Issue

Some customers wants to change the MTU of their NetWitness appliances for the sake of increasing the network performance or to conform to their internal Network infrastructure.

Cause

By default, the NetWitness platform uses an MTU of 1500, which can be confirmed by doing an ifconfig and looking for the MTU value as demonstrated below:

 ifconfig
 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> 
 mtu 1500
 
 inet 192.168.5.166 netmask 255.255.255.0 broadcast 192.168.5.255
 
 inet6 fe80::20c:29ff:fe5e:3d14 prefixlen 64 scopeid 0x20<link>
 
 ether 00:0c:29:5e:3d:14 txqueuelen 1000 (Ethernet)
 
 RX packets 3329321 bytes 2063567074 (1.9 GiB)
 
 RX errors 0 dropped 41 overruns 0 frame 0
 
 TX packets 3379833 bytes 4140217262 (3.8 GiB)
 
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Resolution

There are two ways of changing the MTU on the appliances

1- To change it on fly (the change will take effect immediately but will revert back with network service or host restarted, use:

 ifconfig eth0 mtu 4096 up

  
 Change the eth0 depending on the interface name and 1500 depending on the MTU needed value
 Verify with:

 [root@NW12-LOG-HYBRID ~]# ifconfig eth0 | grep mtu
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 4096

2- To change it permanently,

Edit the following file, changing the eth0 variable to the name of your interface:

 vi /etc/sysconfig/network-scripts/ifcfg-eth0

Add (if missing) or alter the MTU variable within that file to reflect your desired MTU size. In this example, 4096

 MTU=4096
 

Restart network service on the appliance.

 systemctl restart network

Verify the changes:

 ifconfig eth0
 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 4096
 
 inet 192.168.5.166 netmask 255.255.255.0 broadcast 192.168.5.255
 
 inet6 fe80::20c:29ff:fe5e:3d14 prefixlen 64 scopeid 0x20<link>
 
 ether 00:0c:29:5e:3d:14 txqueuelen 1000 (Ethernet)
 
 RX packets 1042 bytes 638766 (623.7 KiB)
 
 RX errors 0 dropped 41 overruns 0 frame 0
 
 TX packets 946 bytes 1424487 (1.3 MiB)
 
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Notes

This optimal value for the MTU should be provided by the customer's network team.

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: All Hosts
NetWitness Version/Condition: 11.x, 12.x
Platform: CentOS, AlmaLinux

Summary

Some customers want to change the network MTU (Maximum Transmission Unit) for their Netwitness appliances to adhere to their infrastructure standards.

Approval Reviewer Queue

Technical approval queue