Is the session.split meta key increased by hitting the max of Assembler
Maximum Size, or is it increased by hitting the max of Capture Buffer
Size? What is the difference between the two of them, and should they
both be set to the same value?
I am witnessing our malware appliance making connections to
cloud.netwitness.com through our internet proxies. This is an undesired
behavior, and we don't want the appliance using the proxies. The proxy
settings are not Enabled, yet it still behaves ...
Thanks, Chris. I happened to notice the same behavior in my tests, as
well. What sparked the question was the new Live Content for "Outbound
Session Greater Than 1GB" App Rule. The description discussed how the
capture buffer size was what incremente...
