0

I am capturing data in homer but packet size is greater than 1500 chars then it is truncating data while storing in database? How can I increase database size in homer?

user3518405
  • 45
  • 2
  • 10
  • i think it isnt truncating when storing to database. i think it is about ethernet MTU size is 1500. check it out. if you're using mirror on switch , try to increase MTU and try again – Yasin Caner Oct 26 '18 at 07:06
  • If I am increasing MTU then I am not able to send any data over network – user3518405 Oct 29 '18 at 09:58

1 Answers1

0

I had this problem before. A few things you can consider are:

1) increase the field on the table where the package is stored to something bigger than 1500, maybe 4000, that resulted for me, i had packages over 3500.

2) if you are using TCP, use param name=“tcpreasm” value=“true”

3) in profile name=“socketspcap_sip" (file etc/captagent/socket_pcap.xml) add the parameter "param name=“snap-len” value=“3500”", this was last one for me, causing problems and truncating the package. Is not documented anywhere, at least i could not find it. Hope this helps.

Victor Gonzalez Chamorro
  • 126
  • 4