How to check Network bandwidth in RSA NetWitness Platform between ESA/Correlation server and Data Source concentrators

[#1]

Article Number

000001032

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7
 

Issue

Network bandwidth is one of the key factors for aggregation performance. 

Resolution

Please use below steps check Network bandwidth between ESA/Correlation server and Concentrator.

1. On Concentrator, Run below command to listen on port 64000 port. Keep command running.
   nc -lk 64000 >/dev/null
    
2. On ESA/Correlation server, Run below command to send traffic 100MB with zero values.
   dd if=/dev/zero bs=10000 count=10000 | nc -v <ConcentratorIP> 64000
   
   This would give Network bandwidth between Servers.

Sample output:

[root@ESA ~]# dd if=/dev/zero bs=10000 count=10000 | nc -v 10.10.11.13 64000
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to 10.10.11.13:64000.
10000+0 records in
10000+0 records out
100000000 bytes (100 MB) copied, 1.02316 s, 97.7 MB/s
Ncat: 100000000 bytes sent, 0 bytes received in 0.86 seconds.

Note: It is always recommended 100 MB/s speed for efficient aggregation performance.