PCAP replay error messages

Incident during PCAP replay

Packet recordings can be reanalyzed by replaying a PCAP file or the packet ring buffer. If the size of the in-memory DB is not large enough to store all measured data, an incident occurs.

This incident will be titled "memory limit reached while processing packets".

Reasons:

• the pcap file or ring buffer is too large to fit into the in-memory DB. This can also happen even if the memory usage shown in System Info Page is still below 90% due to some internal buffers which can be too small depending on the initial memory size.
• the available storage for the optional replay buffer is too small. The replay buffer is used to extract packets from PCAP replays (from storage or via browser upload).

Possible solutions:

• If the PCAP parallel analysis is used, more memory can be reserved to allow analysis of larger files.
• If the free storage space for the replay buffer is not sufficient, delete unused files, use a larger storage device, or disable the use of the replay buffer (in the dialog to start a replay).
• Disable some options in the Global settings to use less memory for the analysis.