SOLVED

Some network traffic is not being analzyed

%3CLINGO-SUB%20id%3D%22lingo-sub-135196%22%20slang%3D%22en-US%22%3ESome%20network%20traffic%20is%20not%20being%20analzyed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-135196%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20sensors%20installed%20on%203%20domain%20controllers%20and%202%20of%20them%20are%20now%20saying%20%22Some%20network%20traffic%20is%20not%20being%20analyzed.%20Sensor%2C%20%24hostname%2C%20is%20receiving%20more%20network%20traffic%20than%20it%20can%20process.%20A%20portion%20of%20the%20network%20traffic%20is%20not%20analyzed.%22%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20worked%20for%20about%20a%20week%20before%20I%20started%20receiving%20this%20error%20message.%20Is%20there%20a%20minimum%20requirement%20for%20the%20ATP%20sensor%20to%20run%20properly%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-140311%22%20slang%3D%22en-US%22%3ERE%3A%20Some%20network%20traffic%20is%20not%20being%20analzyed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-140311%22%20slang%3D%22en-US%22%3EThanks%20this%20worked.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-136177%22%20slang%3D%22en-US%22%3ERe%3A%20Some%20network%20traffic%20is%20not%20being%20analzyed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-136177%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Robert%2C%20Are%20these%20DCs%20running%20under%20VMWare%3F%20If%20so%2C%20then%20it's%20not%20a%20problem%20with%20the%20resource%20allocated%20to%20the%20DC%2C%20but%20you%20will%20need%20to%20make%20a%20change%20to%20the%20NIC%20configuration%20in%20VMWare.%20You%20will%20need%20to%20disable%20the%20%E2%80%9CIPv4%20TSO%20Offload%E2%80%9D%20in%20the%20NIC.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%20me%20know%20if%20this%20resolves%20the%20monitoring%20alert.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

I have sensors installed on 3 domain controllers and 2 of them are now saying "Some network traffic is not being analyzed. Sensor, $hostname, is receiving more network traffic than it can process. A portion of the network traffic is not analyzed." 

 

This worked for about a week before I started receiving this error message. Is there a minimum requirement for the ATP sensor to run properly? 

2 Replies
Best Response confirmed by Robert Wu Admin (New Contributor)
Solution

Hi Robert, Are these DCs running under VMWare? If so, then it's not a problem with the resource allocated to the DC, but you will need to make a change to the NIC configuration in VMWare. You will need to disable the “IPv4 TSO Offload” in the NIC.

 

Let me know if this resolves the monitoring alert.

Thanks this worked.