PCAP replay error messages
Jump to navigation
Jump to search
Incident during PCAP replay
Packet recordings can be reanalyzed by replaying a PCAP file or the packet ring buffer. If the size of the in-memory DB is not large enough to store all measured data, an incident occurs.
This incident will be titled "memory limit reached while processing packets".
Reasons:
- the pcap file or ring buffer is too large to fit into the in-memory DB. This can also happen even if the memory usage shown in System Info Page is still below 90% due to some internal buffers which can be too small depending on the initial memory size.
- the available storage for the optional replay buffer is too small. The replay buffer is used to extract packets from PCAP replays (from storage or via browser upload).
Possible solutions:
- If the PCAP parallel analysis is used, more memory can be reserved to allow analysis of larger files.
- If the free storage space for the replay buffer is not sufficient, delete unused files, use a larger storage device, or disable the use of the replay buffer (in the dialog to start a replay).
- Disable some options in the Global settings to use less memory for the analysis.