Sensor Protocol Violations

The Sensor protocol violation (SPV) error is one of the more common errors that you can receive when using the NetProfiler. The error appears as a system event indicating that the violation occurred between the NetProfiler and one or more reporting devices (Flow Gateway or NetShark). Two potential causes of the SPV error are slow transfers and lack of time synchronization:

Slow transfers - Because the NetProfiler must receive data from remote devices and analyze it all within one 60-second period, there is very little leeway for slow transfers. The NetProfiler allows 48 seconds in each minute for all remote devices to send their data (transfers happen in parallel). Any data sent to the NetProfiler, any data after the 48 seconds is ignored and SPV errors are generated.

If you detect SPV errors, send a file transfer between the NetProfiler and remote device reported in the SPV and calculate how fast data is transferring. If the transfer rate is extremely low and the number of flows is high, this is the likely issue.

If the issue is time sensitive—it only occurs when backups are also running—you must perform the test around the same time that the issue occurred.

Lack of time synchronization - If one NetShark or Flow Gateway is unable to NTP synchronize with the NetProfiler, the time on that device can drift sufficiently from the NetProfiler time. The NetProfiler then has difficulty ensuring that the data being sent is for the same time slice the NetProfiler is currently processing. You must ensure that no firewall or ACL are blocking NTP.