Segment Parameters - Symantec 10521146 - Network Security 7120 Administration Manual

Detecting 175
Configuring sensor detection
UDP Maximum Flow Table Elements (Fast Ethernet)
UDP Maximum Flow Table Elements (Fast Ethernet) regulates the size of the UDP
flow table by controlling the number of simultaneous flows that the fast
Ethernet sensor handles. It has a direct impact on memory consumption.
The default is set to 32,768 for optimum performance and sensitivity, and does
not need to be changed under most circumstances. Valid values range from
16,384 (16K) to 262,144 (256K), inclusive. If you receive an operational log
message indicating that the UDP Flow Table is full, you can eliminate the
message by increasing this value, at the cost of greater memory consumption.
Consider changing it only if you have a thorough understanding of its
functionality.
UDP Maximum Flow Table Elements (Gigabit)
UDP Maximum Flow Table Elements (Gigabit) regulates the size of the UDP flow
table by controlling the number of simultaneous flows that the gigabit sensor
handles. It has a direct impact on memory consumption.
The default is set to 65,535 for optimum performance and sensitivity, and does
not need to be changed under most circumstances. Valid values range from
32,768 (32K) to 1,048,576 (1M), inclusive. If you receive an operational log
message indicating that the UDP Flow Table is full, you can eliminate the
message by increasing this value, at the cost of greater memory consumption.
Consider changing it only if you have a thorough understanding of its
functionality.

Segment parameters

The following parameters regulate the number of incomplete or out-of-order
segments that the sensor tolerates in a queue.
TCP Keepalive Timeout
TCP Keepalive Timeout regulates the period of time in seconds that a TCP
connection can remain idle before it expires. The sensor closes both established
and blocked flows if it remains idle longer than this period of time.
The default is set to 14,400 seconds (4 hours) for optimum performance and
sensitivity, and does not need to be changed under most circumstances. The
minimum value is 1 second. Consider changing it only for troubleshooting
purposes, and with thorough knowledge of its functionality. If you set it too low,
it may ignore or miss connections and impact memory consumption. The
default provides a balance between evasion resiliency and resource
consumption.