NetWitness meta key limits for Text, UInt16 and IPV4 format types

[#1]

Article Number

000003185

Applies To

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Concentrator
NetWitness  Version/Condition: 11.x, 12.x
Platform: CentOS 7 / Alma

Issue

This article contains general information on meta key restrictions for Text, IPv4 and UInt16.

Resolution

In NetWitness, Text based meta keys have a fixed limit of up to 255 characters. 

Generally speaking, the following limitations are imposed:

1. The maximum size of Text meta keys is 255 characters.  Note that meta keys, like columns in a database, may be formatted.
2. A meta key such as ip.src is formatted as IPv4, which has a maximum size of 4 bytes.  
3. A meta key such as tcp.dstport is formatted as UInt16 and has a max bytes of 2, but can accept a value from 0 – 65535.