Sniffer® Portable Professional User's Guide - NetScout

Chapter 7
136 Sniffer Portable Professional
Continues to create new objects by overwriting older objects
in the database (checked)
Stops creating new objects and continues interpreting traffic
according to information already in the database (unchecked)
Specify how often Expert displays are updated with new
data. Configure the Data Update Rate and the Resorting Rate as
desired in within the Objects tab of the Expert UI Object Properties
dialog box. The Resorting Rate specifies the delay between
resorting the Expert’s database of objects and refreshing the
Expert’s summary display.
Notes on Expert Tuning
The Expert Analyzer defaults to a maximum number of objects per layer
of 1000 for most layers. Adjacent to this column is the Est Memory
column, reflecting the estimated amount of memory required to support
the relevant number of objects at each layer. For networks where you
will see many conversations and hosts you will want to do one or both
of the following:
Increase the maximum number of objects at the relevant layer(s)
Disable Recycle Expert Objects
If Recycle Expert Objects is enabled, Expert will attempt to reuse
object memory for a given layer when the maximum count of objects at
that layer is reached. On higher speed networks, it is advised that
recycling is disabled as it can become an issue. If you disable recycling
and hit the maximum counts, any newly detected conversations or hosts
will be ignored. In this situation, it is advised to increase the maximum
number of objects and disable Recycle Expert Objects.
For example, if you run Expert and discover that you are hitting the
maximum count at the IP layer, then increase the maximum number of
objects to 5000. You will also have to increase Layers 4 and perhaps
Layers 6 and 7 because those layers are likely to hit their respective
maximum counts as well. This may take several iterations before you
come up with the best combination of maximum object counts. Each
layer can support up to 99999 maximum objects.
If you increase the maximum object counts then the Expert calculates
expected memory needs. If such expected memory needs exceed the
amount of memory available you will get an error message. At which
point you will have to trim your maximum object counts accordingly. You
can also reduce the maximum object count at those layers that will not
have large object counts so as to conserve available memory. A good
candidate in most cases would be the DLC\MAC layer (Layer 2).