Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Response: Why does my sensor upload data faster than the configured throttle rate?

Cb Response: Why does my sensor upload data faster than the configured throttle rate?

Environment

  • All Cb Response versions

Question

The site is set to throttle at 50 KB/s but uploads from individual sensors have been observed at over 200 KB/s.  Why are the sensors not complying with the configured throttling rate?

Answer

Throttling is not performed per sensor. It is performed per site by the server. When sensors check in, the server tells them how much data to send and when to send it. The server will keep the average speed for the entire site at or below the configured rate but individual uploads are not throttled. It is normal to see individual uploads exceed the configured rate.

Additional Notes

Carbon Black Response (CbR) Site Throttling is a feature that allows for control of data upload speed to the server from sensors in a particular site.  This is a separate feature from the default sensor throttling.

Sensor Throttling

CbR, by default, uses sensor throttling to control the rate at which data is submitted from the sensors to the server. Server utilization statistics are collected as well as information about the amount of data awaiting upload that is cached on the endpoints. A proprietary algorithm uses this data to determine the optimal transfer rate.  When a sensor checks in,  the server responds by telling it how much data to upload. Note: The server only tells the sensor how much data to send, not how fast to send it.

Site Throttling

Site throttling is an optional configuration that can control the amount of data being submitted over a given period of time by a specific subset of sensors. Because throttling works by controlling the amount of data sent, not the speed of the connection, there will be spikes in bandwidth utilization. The average speed over time, however, will not exceed the configured amount.

Related Content

Cb Response: Sensors Upgrading Faster Than Configured Settings

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-02-2018
Views:
1450
Contributors