topic Re: session offfload and flow basic in General Topics

session offfload and flow basic

MP18 — Wed, 10 Oct 2018 15:25:27 GMT

When we do session offload then PCAP can not capture the session offload traffic .

if i am also doing flow basic on that then flow basic will not be impacted by session offload?

Regards

Mike

Re: session offfload and flow basic

LukeBullimore — Fri, 12 Oct 2018 15:50:30 GMT

Hey @MP18

Correct. A flow basic will not be able to capture any traffic if it has been offloaded so if you're wanting to do a flow basic for any SSL traffic, for example, then it is important to disable session offloading for the duration of your capture/testing.

Disabling session offloading is a global setting and will add some additional overhead processing to the dataplane so it is important to remember not to run a flow basic if the dataplane CPU is high. The traffic itself will not be impacted by session offloading being disabled. Other important factors to remember are:

- Always apply filters when doing any sort of traffic capturing

- Do not attempt to modify the filters whilst logging is enabled; first, disable logging then modify your filters.

Cheers,

Luke.

Re: session offfload and flow basic

MP18 — Fri, 12 Oct 2018 17:10:27 GMT

Great reply!

One last thing if i enable PCAP filters and do session offload will it offload only sessions filterd in pcap

or it will offload all the traffic?

Re: session offfload and flow basic

LukeBullimore — Fri, 12 Oct 2018 20:22:16 GMT

Hey @MP18

Session offloading is a global setting meaning it will take effect on all traffic.

Thanks,

Luke.

Re: session offfload and flow basic

MP18 — Fri, 12 Oct 2018 20:29:14 GMT

Many Many Thanks !