Skip to content
  • There are no suggestions because the search field is empty.

NetWItness Issues with packet drops after upgrading to 12.5

Issue

After upgrading to 12.5, (from a release prior to 12.4), some customers may experience packet drops as a result of using deprecated Live Feeds.


Cause

The issue is with the Dynamic DNS Domain Feed and it should be disabled on customer environments as it is discontinued.


Workaround

If CCM is not managing the decoder, you can remove the feed by doing the following:

  • Navigate to the Admin > Services> Decoder > Config > Feeds
  • Click the Checkbox next to the feed, and click the Minus ( - ) sign.
    • Note, the example below does not include the actual feed and is only representative of how to delete any specific feed:

      NetWItness Issues with packet drops after upgrading to 12.5

If CCM is managing the Decoder Services, do the following:

  • Navigate to Configure > Policies > Content> Policies and choose the applicable policy and click "Edit":
    NetWItness Issues with packet drops after upgrading to 12.5
  • Remove the feed from the Selected Content pane by choosing the "x" icon, and then click "Save and Publish":
    NetWItness Issues with packet drops after upgrading to 12.5
  • You can confirm the feed has been deleted by going to the legacy interface and ensuring it is no longer present under Admin > Services> Decoder > Config > Feeds ,

Resolution

Issue resolved after customer disabled the Dynamic DNS Domain feed


Product Details

RSA Product Set: NetWitness Logs and Packets
RSA Product/Service Type: Log Decoder, Packet Decoder, Centralized Content Management (CCM)
RSA Version/Condition: 12.5+
Platform: AlmaLinux


Approval Reviewer Queue

Technical approval queue