2 Replies Latest reply on Mar 21, 2016 4:21 AM by peter.mason

    L7 Data Collection

    syntyche_ackerley


      Percentage (%) of Flows that Capture Layer 7 Data: 20

      Maximum Number of Concurrent TCP/UDP Flows Supported on this Device: 654149


      Hello there!


      Have anyone of you tried to play with L7 Data collection settings?

      The official NSP_83_Best_Practices_Guide_revA_en-us.pdf guide gives you a nice table about the capabilities of certain sensors, and I'm seriously considering to put mine to a full 100%.


      What is your experience with L7 Data collection?


      For ex.:

      M-2850 sensor:

      L7 data collection: disabled

      Throughput: 600 Mbps

       

      L7 data collection: 5%

           HTTP scan: in

           Throughput: 540 Mbps

           HTTP scan: in and out

           Throughput: 261 Mbps

       

      L7 data collection: 100%

           HTTP scan: in

           Throughput: 522 Mbps

           HTTP scan: in and out

           Throughput: 253 Mbps

        • 1. Re: L7 Data Collection
          msitko

          There is an impact to the sensor as you stated above, but if you have the throughput overhead available to take advantage of it, then you should have no problems setting it to 100%.

          • 2. Re: L7 Data Collection
            peter.mason

            Hi syntyche_ackerley,

             

            You will also need to consider the volume of data your sensors will be sending to the manager, if you are increasing this on multiple sensors it can increase the volume of traffic to the manager and causes congestion.

             

            This will also increase the size of your database, so you will also need to account for that.

             

            Peter