Troubleshooting Desynchs in Extrahop


#1

I need to determine a process to troubleshoot the cause of extrahop Desyncs. I also need to find a way to provide a report that lists detailed data about desyncs as opposed to just the number of desyncs that occur. Is this possible.


#2

Desyncs are for all practical purposes a hole in your data feeds. There are reasons this can happen on the EH and off.

For example if you plug into a new network or VLAN, you’ll be dropping into the middle of existing sessions. Naturally you’ll be missing some data – Desync!

If your upstream SPAN aggregators are trying to put 40 Gigs of data down a 10 Gig trunk to the EH – Desync!
I recommend you take a look at things with the ExtraHop support team.