1 – Packet Capture Memory – All data that is captured by a network card that is to be displayed in a LIVE capture/decode is placed into this memory buffer. All packets received that are to be analyzed by the GSCP prior to being written to disk are placed in this memory buffer. The larger the memory buffer, the greater the number of packets can be held in memory in order to be processed. Depending on what is going on with the CPU, amount of data coming into the system, amount of data being written to disk, and so on, there will be a need to queue up packets for processing. If the memory buffer is too small, then packets will be lost. If you are running GSCP, they would be lost prior to being written to disk, as indicated in a previous screenshot which shows a number of data loss periods within the Observer Alarm Log window.
2 – Statistics Queue Buffer – All data seen that is to be analyzed for any other portion of the application is placed into this memory buffer. This would include Network Trending, Top Talkers, Triggers and Alarms. Again, as with Packet Capture, data can be lost here if there is not enough memory available to keep up with the amount of data coming into the unit which needs to be processed.
You may notice that within Network Trending there is a FIFO % column. This shows how far behind in data processing each portion is compared to amount of data total in memory. If FIFO shows 10%, then it is 10% behind, meaning it has processed 90% of the packets in the Statistics Queue Buffer. As long as you don’t see this % creeping up to 100% then going back to 0%, you are not losing packets within the Statistics Queue Buffer.
3 – O/S Reserved Memory – While this memory is not used for doing packet captures, writing data to disk or analyzing statistical information, it is used anytime you open a packet capture buffer. Doing a data mine from the GSCP uses this memory. If you mined out 20GB of data, that would use the O/S reserved memory and not the Packet Capture or Statistics Queue Buffer.
The larger this is, the faster data can be analyzed post capture. Therefore by lowering the amount of reserved memory for the O/S you increase the amount of time it takes to analyze data captured data.
This document was generated from the following discussion: Some things to keep in mind about memory: