All Apps and Add-ons

Stream App - TCP reassembly queue size

New Member


I'm using Splunk App 7.1.0 to capture HTTP traffic and I got several warning messages like below :

2017-04-11 13:07:11 WARN 140491406145280 stream.SnifferReactor - TCP reassembly queue overflow [c=, s=]

1) Is there any parameter to increase TCP reassembly queue size? I already increase the maxTcpReassemblyPacketCount to 1000000 but it's not helpful.

2) Does any packet loss possible when this warning happend?

Thanks in advance

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Hello @sttkyo,

TCP reassembly queue overflow usually occurs when there's some issue with reassembling TCP packet flow for the deep packet inspection layer. One of the most common cases is when only one side of the conversation is captured. Currently there's no parameter to increase the TCP reassembly queue size. This warning doesn't cause packet loss per se, but it may cause degradation of the quality of Stream generated data.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...