Threads for analyzer

Question

Question by Sharyl K. · Oct 17, 2014 at 01:21 AM ·

Threads for analyzer

we are on DCRUM version 12.2. What's the maximum threads AMD can be configured for HTTP, HTTPS, SOAP/XML?

0

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Answer 1 · 2014-10-17T19:17:43Z

Answer by Wojciech K. · Oct 17, 2014 at 07:17 PM

Correct. Decodes are not bound to particular CPUs and the AMD will equally balance traffic between all 5 threads automatically - in your case (20% http, 80% https), 1 thread would process http traffic and 4 of them - https.

0 Show 1 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Sharyl K. · Oct 17, 2014 at 07:20 PM 0

Share

Thanks for clarification

Answer 2 · 2014-10-17T19:02:36Z

Answer by Wojciech K. · Oct 17, 2014 at 07:02 PM

This is the number of threads performing SSL decryption - they are separate from the regular analysis threads. 4 is a fine value, provided that the machine has enough CPUs, increasing it further won't help though.

In general, the 5 thread limit relates to packet analysis threads. The whole AMD uses a lot more threads for other tasks, like the mentioned SSL decryption, reading packets from NICs and dispatching them, sequenced transaction assembly, etc. That's why a larger amount of CPUs is required.

0 Show 1 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Sharyl K. · Oct 17, 2014 at 07:11 PM 0

Share

so we don't need to specify threads to decode each type of traffic - http/https and SOAP/XML? if we assign one AMD only process https traffic then the load will be balanced through 5 threads, right? if one AMD has mix http (20%) and https (80%) how to make sure it assigns enough threads to handle https traffic?

Answer 3 · 2014-10-17T18:05:46Z

Answer by Wojciech K. · Oct 17, 2014 at 06:05 PM

It's 5 threads per AMD, not decode. The traffic for all decodes will be balanced between those 5 threads.

0 Show 1 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Sharyl K. · Oct 17, 2014 at 06:56 PM 0

Share

if I have this in rtm.config - what's impact?

ssl.engine.param=threads:4

FYI - this was recommendation from support team for one of old tickets

Answer 4 · 2014-10-17T14:19:57Z

Answer by Wojciech K. · Oct 17, 2014 at 02:19 PM

Sharyl,

The maximum number of analysis threads on the AMD is 5. Nothing has changed for 12.2 in this matter.

Wojtek.

0 Show 1 · Share

10 |2000000 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

Sharyl K. · Oct 17, 2014 at 06:03 PM 0

Share

so we can have on one AMD -

5 - http

5 - https

5 - ssl(or same as https)

5 - SOAP/XML

right?

Threads for analyzer

4 Replies

How to get started

NAM 2019 SP5 is available

LIVE WEBINAR

Follow this Question

Forum Tags