Improve Security Analytics Appliance PCAP download performance

Products

• Security Analytics

Issue/Introduction

What is the standard PCAP download performance?

Can PCAP download performance be tuned?

Resolution

Many things can impact performance of PCAP download including the local client OS and network between the client and SA. The fastest we have been able to measure is about 550Mbps of PCAP download.   
The downloaded of PCAP required gathering all the right data from the slots and could involve multiple slots that cause the performance to degrade.
 

Below are the component that could affect the performance:

• Gauge filter..  That may or not be in your control, depending on is needed.  Using PCAP download without filters is much slower.  
• Capture rates.  If you’re pushing the limits of capture/index on a sensor, PCAP download will be slower. 
• The transport method.   
• The network – downloading over WIFI is much slower than ethernet.
• The client system – Hard disk rates will impact what you can download at.  

Using a dedicated NFS (Network File System) mount to SA with a high speed connection and disks should get you some of the fastest rates.  We have previously suggested customer to download via the NFS connection as engineering regularly imported a 40 GB PCAP using an NFS connection, it always went surprisingly fast. Definitely close to an hour. Browser upload is a whole different thing and we would not recommend even trying it on large download.