Access official resources from Carbon Black experts
All Cb Response versions
The site is set to throttle at 50 KB/s but uploads from individual sensors have been observed at over 200 KB/s. Why are the sensors not complying with the configured throttling rate?
Throttling is not performed per sensor. It is performed per site by the server. When sensors check in, the server tells them how much data to send and when to send it. The server will keep the average speed for the entire site at or below the configured rate but individual uploads are not throttled. It is normal to see individual uploads exceed the configured rate.
Carbon Black Response (CbR) Site Throttling is a feature that allows for control of data upload speed to the server from sensors in a particular site. This is a separate feature from the default sensor throttling.
CbR, by default, uses sensor throttling to control the rate at which data is submitted from the sensors to the server. Server utilization statistics are collected as well as information about the amount of data awaiting upload that is cached on the endpoints. A proprietary algorithm uses this data to determine the optimal transfer rate. When a sensor checks in, the server responds by telling it how much data to upload. Note: The server only tells the sensor how much data to send, not how fast to send it.
Site throttling is an optional configuration that can control the amount of data being submitted over a given period of time by a specific subset of sensors. Because throttling works by controlling the amount of data sent, not the speed of the connection, there will be spikes in bandwidth utilization. The average speed over time, however, will not exceed the configured amount.
Cb Response: Sensors Upgrading Faster Than Configured Settings
Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.