Showing results for 
Search instead for 
Did you mean: 

L7 Data Collection

Percentage (%) of Flows that Capture Layer 7 Data: 20

Maximum Number of Concurrent TCP/UDP Flows Supported on this Device: 654149

Hello there!

Have anyone of you tried to play with L7 Data collection settings?

The official NSP_83_Best_Practices_Guide_revA_en-us.pdf guide gives you a nice table about the capabilities of certain sensors, and I'm seriously considering to put mine to a full 100%.

What is your experience with L7 Data collection?

For ex.:

M-2850 sensor:

L7 data collection: disabled

Throughput: 600 Mbps

L7 data collection: 5%

     HTTP scan: in

     Throughput: 540 Mbps

     HTTP scan: in and out

     Throughput: 261 Mbps

L7 data collection: 100%

     HTTP scan: in

     Throughput: 522 Mbps

     HTTP scan: in and out

     Throughput: 253 Mbps

0 Kudos
2 Replies
Level 10

Re: L7 Data Collection

There is an impact to the sensor as you stated above, but if you have the throughput overhead available to take advantage of it, then you should have no problems setting it to 100%.

0 Kudos
Level 13

Re: L7 Data Collection

Hi syntyche_ackerley,

You will also need to consider the volume of data your sensors will be sending to the manager, if you are increasing this on multiple sensors it can increase the volume of traffic to the manager and causes congestion.

This will also increase the size of your database, so you will also need to account for that.


0 Kudos