SA Fails to export pcap/Overall broker slowness/Wierdness/PIA

[Anonymous]

I've been running in to a problem using the web interface and actually getting data to export in to a pcap.

it seems that more often then not, my pcap exports will fail from the web UI, but using the fat client i am able to retrieve the data.

In the web interface the amount of sessions seems to be irrelevant, as well as what data source i am selecting(broker vs concentrator)

this has existed for me since the upgrade to 10.3sp1( or there abouts) and i'm currently running 10.3.3.2517, and its still persisting.

RSA people, any ideas?

-mark

[huanzhou1]

not sure what you mean by the old session still showing?any screenshot?

[Anonymous]

stale sessions.

[huanzhou1]

i'm not sure whether any timeout setting for the session or not. Can you check all the session the source ip address? Do you have malware/spectrum？

[huanzhou1]

The10.3.3 released, but i tried to export, the pcap exported all empty.

[huanzhou1]

my fault, forgot to connect the decoder.

Just fyi, 10.3.3 fixed the problem, you may download and upgrade.

[Anonymous]

my export still fails(10.3.3) and has the awesomeness to cause something else to crash at the same time when i start the process. so anything i had going on in an investigator view fails with a connection refused error.

Failed to retrieve distinct values for specific field across range 1 to 129642016381 : I/O error: The target server failed to respond; nested exception is org.apache.http.NoHttpResponseException: The target server failed to respond

[huanzhou1]

Looks like connection issue to me, can you re-add the concentrators? Also re-add the aggregated decoders.

[Anonymous]

sorry for the delayed response but this has failed to resolve the issue as well. removing the concentrator sources from the broker, as well as removing the decoders from the concentrator, still results in a failure through the broker.

[huanzhou1]

can you run rpm -a | grep nwbroker ? just want to confirm your broker version.

[Anonymous]

nwbroker-10.3.3.2517-5.el6.x86_64