This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
      • Netwitness XDR
      • EC-Council Training
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
    • Role-Based Training
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Discussions
  • NetWitness Community
  • Discussions
  • SA Fails to export pcap/Overall broker slowness/Wierdness/PIA
  • Options
    • Subscribe to RSS Feed
    • Mark Topic as New
    • Mark Topic as Read
    • Float this Topic for Current User
    • Bookmark
    • Subscribe
    • Mute
    • Printer Friendly Page

SA Fails to export pcap/Overall broker slowness/Wierdness/PIA

markd
markd Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 10:52 AM

I've been running in to a problem using the web interface and actually getting data to export in to a pcap.

it seems that more often then not, my pcap exports will fail from the web UI, but using the fat client i am able to retrieve the data.

 

In the web interface the amount of sessions seems to be irrelevant, as well as what data source i am selecting(broker vs concentrator)

this has existed for me since the upgrade to 10.3sp1( or there abouts) and i'm currently running 10.3.3.2517, and its still persisting.

 

RSA people, any ideas?

 

-mark

  • Community Thread
  • Discussion
  • export
  • fatclient
  • Forum Thread
  • NetWitness
  • NW
  • NWP
  • pcap
  • RSA NetWitness
  • RSA NetWitness Platform
Preview file
12 KB
0 Likes
Share
Reply
  • All forum topics
  • Previous Topic
  • Next Topic
24 REPLIES 24

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 12:11 PM

Hi Mark,

 

I haven't seen this reported yet. Let me take the screen cap and the errors and get them into our folks to see what happening (or not happening as the case may be). 

0 Likes
Share
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 12:15 PM

Hey Mark- How many sessions are you trying to export? (for the failed instances)

0 Likes
Share
Reply

markd
markd Beginner
Beginner
In response to RSAAdmin
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 12:39 PM

the amount of sessions seems to be irrelevant, but i have verified that even with the fat client exports will fail when attempting to do them through the broker. ( which kinda defeats the purpose of the broker)

0 Likes
Share
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
In response to markd
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 12:45 PM

Gotcha Mark. I've created a ticket for our engineers inkling your symptoms, versions, and screenshot.  Feel free to ping me directly if you have any more data I should provide to the team or just have questions in general regarding this issue.  michael.shreve@rsa.com

0 Likes
Share
Reply

markd
markd Beginner
Beginner
In response to RSAAdmin
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-01 01:28 PM

michael,

thanks for the help i have emailed some additional data.

 

mark

0 Likes
Share
Reply

huanzhou1
huanzhou1 Beginner
Beginner
In response to markd
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-02 03:54 AM

it's bug, i have the same issue, opened case with support but no update yet.  It's due to the hotfix issue.

 

you need to downgrade to 10.3.2(replace with the old NwBroker file or install rpm) . Or you can export using the navigate view.

 

If you downgrade, you cannot connect broker to broker.

0 Likes
Share
Reply

RSAAdmin
RSAAdmin Beginner
Beginner
In response to huanzhou1
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-02 07:52 AM

Patriot- do you have a number on that ticket so I can combine the two and light fire where appropriate?

0 Likes
Share
Reply

markd
markd Beginner
Beginner
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-02 12:10 PM

another "feature" I've noticed with the broker is the fact that it likes to hold sessions open/active for quite a while, in looking through the system info under devices, i have sessions still showing that where opened yesterday morning/afternoon.

is there a setting within the explorer config or else where that can correct this?

0 Likes
Share
Reply

huanzhou1
huanzhou1 Beginner
Beginner
In response to RSAAdmin
Options
  • Mark as New
  • Bookmark
  • Subscribe
  • Mute
  • Subscribe to RSS Feed
  • Permalink
  • Print
  • Report Inappropriate Content

‎2014-05-02 12:50 PM

case id: 00471224

0 Likes
Share
Reply
  • « Previous
    • 1
    • 2
    • 3
  • Next »
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.