Product FAQ

Products and deployment

What does each Capuris product do?

Capuris Capture Appliances record packet data at an observation point. Capuris Control configures recording, search, users, networking, retention, and related services. Capuris Insight analyzes packet-derived relationships, flows, alerts, and reports. Capuris AI distributes supported analytics workloads across worker nodes.

Can capture run on physical and virtual systems?

Yes. Portable and rack appliances provide purpose-built capture profiles, while Capuris Capture Virtual runs in a supported virtual environment. Virtual performance depends on the mirror source, virtual networking, host scheduling, storage, and packet distribution.

How should we choose an appliance?

Measure sustained and peak traffic, packet size, retention, interfaces, optics, storage protection, and concurrent search or transfer work. Choose from those measurements rather than link speed or chassis size alone. See Capture appliances.

Which transceivers are supported?

Support depends on model, adapter, speed, breakout, firmware, and optical design. Confirm the exact Capuris SKU and both ends of the link before ordering or installing optics.

What should be ready before installation?

Prepare rack and power, BMC and management addressing, DNS, routes, time synchronization, capture sources, optics, administrator accounts, retention policy, and a test plan. See Deployment and quick start.

Capture and search

What determines capture performance?

Adapter capability, average packet size, offered rate, filtering, slicing, compression, storage throughput, and simultaneous work all contribute. Validate the complete configuration with representative traffic and monitor capture-drop counters.

Why is a date-and-time search slow?

A broad time range, many input files, reordering, complex filters, remote storage, or competing jobs can increase duration. Narrow the time and input set first. Check resource and storage health before assuming the job is stuck.

Can two packet searches run at once?

Some releases and deployments allow concurrency, but simultaneous searches compete for CPU, memory, and storage. Follow the limits for the installed version and avoid duplicate jobs.

What does Reorder Output PCAP do?

It arranges packets from the selected inputs by timestamp. This is useful after combining files, but it adds processing and requires trustworthy source timestamps.

What do Compression and Rotation mean?

Compression attempts to reduce stored size at added processing cost. Rotation controls how capture files are segmented or reused according to the configured retention behavior. Test both settings with real traffic before production use.

Can access to start and stop capture be restricted?

Use named accounts, groups, and the least privilege available in the installed release. Validate the role with a non-destructive test before granting production access.

Administration and protection

Is IPv6 supported?

IPv6 support varies by product feature and release. Confirm management, capture, search, reporting, and API requirements separately rather than treating IPv6 as one platform-wide switch.

How can capture data be protected?

Available methods include local snapshots, NFS transfers, snapshot mirroring, and full remote mirror. A copy is not a recovery plan until a restore has been tested. See Control administration.

How long does a mirror take?

Duration depends on changed data, file count, source and destination storage, bandwidth, latency, encryption, and concurrent capture. Measure an initial full transfer and a typical incremental transfer, then schedule with headroom.

How do we reduce mirror impact?

Run large transfers outside peak capture and search periods, limit the selected data, confirm destination performance, and monitor capture drops and storage latency during a representative test.

Insight analytics

How do saved search templates work?

Create a reusable shortcode or template from a reviewed set of search inputs and filters. Name it by purpose, document sampling and time assumptions, and update it when decoder or field behavior changes.

Why does an inline search fail?

Check expression syntax, supported fields, quoting, file format, input availability, and backend service health. Reduce the filter to one known condition, verify it, then add terms incrementally.

Why do graph links have different colors?

The active aspect and graph rules determine visual styling. Read the legend and rule definitions before treating a color as a warning.

What does Potential Malicious Node mean?

It is a lead created by an analytic rule, IDS result, reputation source, or behavior—not a final determination. Inspect peers, timing, underlying packets, and corroborating security telemetry.

What is the difference between full and sampled analysis?

Full analysis processes all selected input. Sampling reduces processing for exploration but may miss low-volume or short-lived traffic. A sampled result cannot prove absence.

Why disable rendering?

Rendering a large graph can consume browser and platform resources. Disable it when exact tables, reports, or exports are needed but an interactive visualization is not.

How are multiple Insight accounts removed?

Use Administration Manager and follow the bulk or individual workflow supported by the release. Reassign owned searches and operational responsibilities before deletion, and keep at least one tested administrator.

Cloud analytics

Where are pricing and service limits published?

Cloud plans change over time. Contact Capuris for current pricing, storage, processing, retention, support, and data-residency terms.

How is PCAP uploaded?

Use the approved browser or client upload workflow. Wait for the file size to stabilize, verify integrity, and then refresh or index it. Upload only data the cloud environment is authorized to process.

Is PCAPNG accepted?

Input-format support is release- and service-specific. Confirm the current service requirements; convert a copy to standard PCAP when needed while retaining the original.

Are hosted and self-managed Insight identical?

Core analysis concepts may be shared, but limits, administration, integration, update control, and data handling can differ. Validate the features required for the planned workflow.

Support

How often is software updated?

Release timing varies. Subscribe to the designated support channel and review compatibility, backup, maintenance, and validation requirements for every update.

What does “Error Found” mean on the Control page?

It indicates that a monitored component needs attention, not a diagnosis by itself. Open the detail, record its timestamp and message, then inspect service and system evidence. See Support and troubleshooting.

What should accompany a bug report?

Include system and version, exact steps, expected and observed results, timestamps with time zone, recent changes, sanitized logs, and the smallest safe PCAP or screenshot that reproduces the problem.