I need to determine a process to troubleshoot the cause of extrahop Desyncs. I also need to find a way to provide a report that lists detailed data about desyncs as opposed to just the number of desyncs that occur. Is this possible.
Desyncs are for all practical purposes a hole in your data feeds. There are reasons this can happen on the EH and off.
For example if you plug into a new network or VLAN, you’ll be dropping into the middle of existing sessions. Naturally you’ll be missing some data – Desync!
If your upstream SPAN aggregators are trying to put 40 Gigs of data down a 10 Gig trunk to the EH – Desync!
I recommend you take a look at things with the ExtraHop support team.