[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] SP and WAN performance



We are having the same issues with bandwidth utilization. Average of 474,354 bytes per minute or so. See the log table.
We have two RS 6.5 sensors deployed in the DMZ and they report back to SP 2.0 and generation an average of 700 MB traffic  per day and all this is related to control channell traffic between SP and the Server with sensors on it. There are only couple of alerts per day so it can not event related.
Is there a way to configure the SP to poll the sensor server differently or something?

Date

Time

Service

Source

Destination

Proto

Elapsed

 Bytes

14-May-03

 7:24:47

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:05

 474,757

14-May-03

 7:26:26

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,354

14-May-03

 7:26:37

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,717

14-May-03

 7:28:18

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,597

14-May-03

 7:28:30

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:05

 474,877

14-May-03

 7:30:10

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,274

14-May-03

 7:30:19

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,154

14-May-03

 7:32:01

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 475,120

14-May-03

 7:32:12

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:05

 474,837

14-May-03

 7:33:53

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,637

14-May-03

 7:34:02

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,154

14-May-03

 7:35:44

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,154

14-May-03

 7:35:53

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,517

14-May-03

 7:37:35

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:03

 474,154

14-May-03

 7:37:46

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,274

14-May-03

 7:39:27

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,757

14-May-03

 7:39:37

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,234

14-May-03

 7:41:18

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,797

14-May-03

 7:41:29

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,234

14-May-03

 7:43:10

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,757

14-May-03

 7:43:20

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,757

14-May-03

 7:45:02

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:05

 474,757

14-May-03

 7:45:11

TCP-2998

XXX.XXX.XXX

XXX.XXX.XXX

tcp

0:00:04

 474,154

 

Wassim Nakadi <wnakadi@xxxxxxxxxx> wrote:
One thing i am sure off: SP is not just a LAN technology. Its an enterprise software.
But probably a Basic installation does not provide better load than this.
-----Original Message-----
From: S J [mailto:sjnospam@xxxxxxxxx]
Sent: Saturday, May 31, 2003 4:54 PM
To: issforum@xxxxxxx
Subject: [ISSForum] SP and WAN performance

I have a problem with the amount of traffic that the
SiteProtector server generates when it opens the control channel to the
Sensors to get system information.  The average load is averaging
150kbs/for 40 seconds/every 2 minutes.  From what I understand, this is
hard coded into SiteProtector.

This creates a pretty significant problem when I have a 512kb wan link
with 4 sensors on one end and SP on the other. 

The event collector has nothing to do with this, so adding event
collectors remotely does not help.  The traffic is not event related.
 
Event traffic sits at about 1 to 3 kbps on average.

Support tells me that the solution is application servers need to
be on the same LAN.  One that is not an acceptable answer and 2 the
Application Server Service being off on a "Basic Installation" does not
affect the traffic generated.

Any ideas or more information on the subject?? 
Any help would be appreciated.
 
Support has told me that you cannot change how often the SP server polls the sensors.  Also, Support told me SP is designed to work only in a LAN environment.
 
Upping the WAN link speeds is not an acceptable tolution.  SiteProtector is an Enterprise application and should behave that way.
 
 
 
Thanks
SJ

 


Do you Yahoo!?
Free online calendar with sync to Outlook(TM).


Do you Yahoo!?
Free online calendar with sync to Outlook(TM).