Packet Capture Download Optimization
Packet capture download optimization enables specific improvements to the speed at which packets are downloaded for specific objects such as individual IP addresses, IP conversations, etc. Consequently, it speeds up packet analysis workflows in the AppResponse web UI and in Packet Analyzer Plus. Faster access to packets occurs when the following information is used to find the packets of interest: source IP, destination IP, and IP pair.
The Create Job dialog provides these controls for this feature:
◼ Optimize For Capture Speed (default)
◼ This captures packets to disk at the highest rates allowed by the appliance’s resources.
◼ This setting is recommended if capturing packets at very high rates is critical and both of the following conditions apply:
– The AppResponse appliance model is 8170 or 8180 Plus.
– There are four or more storage units attached.
◼ Advanced indexing information to speed up packet access will not be created, and the packet access speed will be slower.
◼ Optimize For Download Speed
◼ This optimizes high-speed access to, and download of, packets from the AppResponse web UI or Packet Analyzer Plus.
◼ This setting is recommended for all other AppResponse models and configurations.
◼ Enabling this will affect the download speed only for packets that are written for this capture job after the setting is turned on. Packets captured previously (when the setting was off) will be accessed at reduced speeds.
When you begin to download a capture job, the Download Packets dialog displays the download’s estimated size, giving you some idea of how long the download process could take.
Be aware of these nuances when considering packet download size estimates:
◼ This packet download size estimate is derived from pre-calculated metadata about the packets that are stored on disk, i.e., the estimate is not based on actually looking at the packets stored on disk. This metadata is calculated for all IP traffic regardless of which packets are written to disk based on your capture job configuration. It is possible that you will see a packet download size estimate even if your capture job configuration doesn’t capture the corresponding packets to disk. Always make sure your capture job configuration is broad enough to meet your future packet access needs, e.g., be conscious of the scope of the capture job filters you specify.
◼ The packet download size estimate does not take into account any additional filtering you may have specified in the BPF section.