NetWitness meta key limits for Text, UInt16 and IPV4 format types

Issue

This article contains general information on meta key restrictions for Text, IPv4 and UInt16.

Resolution

In NetWitness, Text based meta keys have a fixed limit of up to 255 characters. 

Generally speaking, the following limitations are imposed:

1. The maximum size of Text meta keys is 255 characters.  Note that meta keys, like columns in a database, may be formatted.
2. A meta key such as ip.src is formatted as IPv4, which has a maximum size of 4 bytes.  
3. A meta key such as tcp.dstport is formatted as UInt16 and has a max bytes of 2, but can accept a value from 0 – 65535.

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Concentrator
NetWitness  Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma

Approval Reviewer Queue

Technical approval queue