The percentage of alien packets

About this task

The percentage of packets that are encountered in the capture stream that the DNCA cannot associate with an existing connection. When capture is first started, this number is expected to be a high percentage. But as capture continues to associate and process hits, this figure must drop.

Analysis: If this metric is marked in red, the quality of the data that is sent to the DNCA or the TCP connections must be improved. Here are some suggested approaches.

Procedure

  1. Apply traffic filters: If you not done already, you can apply filters to remove unwanted traffic that is being forwarded to the DNCA. Traffic filters can be applied to port ranges or IP addresses.
  2. Capture Mode: If the DNCA is configured to be in BusinessIT mode, more data is captured, which cannot be important. Alien packet counts can drop if you switch the DNCA to capture in Business mode. See Pipeline Settings.
  3. After you make changes to the above, you must restart the DNCA. See Installing the Network Capture Application.
  4. Check hardware: The SPAN port that is used to deliver hits to the DNCA can be dropping some, due to oversubscription. Verify with your IT department that data is not being lost by the SPAN port.
    • High alien packet counts and missing pages can be associated with improperly functioning NIC card on the machine hosting the DNCA. You must also review and update, if needed, the driver for the NIC card.
  5. Bad checksums: If there are a significant number of bad checksums, you must check with your IT staff to verify that the source of the traffic that is forwarded to the DNCA is generating valid checksums.
    • To test the validity of the checksums in the packet data, you can enable checksum validation through the Interface tab. Validation is enabled by default. See DNCA Web Console - Interface Tab.
  6. Additional information can be available in the statistics log, which you can download from the DNCA web console. See DNCA Web Console - Backup-Logs Tab.
  7. You can enable archiving in the DNCA, which delivers raw network packets to the designated archive and can be useful for debugging issues in session data.