PCAP replay error messages: Difference between revisions
Access restrictions were established for this page. If you see this message, you have no access to this page.
(Created page with "== PCAP replay error messages == === Incident during PCAP replay === Packet recordings can be reanalyzed by replaying a PCAP file or the packet ring buffer. If the size of t...") |
No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
== Incident during PCAP replay == | |||
Packet recordings can be reanalyzed by replaying a PCAP file or the | Packet recordings can be reanalyzed by replaying a PCAP file or the | ||
| Line 12: | Line 10: | ||
Reasons: | Reasons: | ||
* the pcap file or ring buffer is too large to fit into the in-memory DB. This can also happen even if the memory usage shown in [[ | * the pcap file or ring buffer is too large to fit into the in-memory DB. This can also happen even if the memory usage shown in [[System Info Page]] is still below 90% due to some internal buffers which can be too small depending on the initial memory size. | ||
* the available storage for the optional replay buffer is too small. The replay buffer is used to extract packets from PCAP replays (from storage or via browser upload). | * the available storage for the optional replay buffer is too small. The replay buffer is used to extract packets from PCAP replays (from storage or via browser upload). | ||
Latest revision as of 13:28, 4 May 2020
Incident during PCAP replay
Packet recordings can be reanalyzed by replaying a PCAP file or the packet ring buffer. If the size of the in-memory DB is not large enough to store all measured data, an incident occurs.
This incident will be titled "memory limit reached while processing packets".
Reasons:
- the pcap file or ring buffer is too large to fit into the in-memory DB. This can also happen even if the memory usage shown in System Info Page is still below 90% due to some internal buffers which can be too small depending on the initial memory size.
- the available storage for the optional replay buffer is too small. The replay buffer is used to extract packets from PCAP replays (from storage or via browser upload).
Possible solutions:
- If the PCAP parallel analysis is used, more memory can be reserved to allow analysis of larger files.
- If the free storage space for the replay buffer is not sufficient, delete unused files, use a larger storage device, or disable the use of the replay buffer (in the dialog to start a replay).
- Disable some options in the Global settings to use less memory for the analysis.