How to guarantee the completeness of audit records without any loss of packet?
Completeness of recording data is guaranteed from the following two aspects in SA: a. SAS works in line as a transparent proxy and its impossible for any packet to bypass SAS or to be dropped. For those sniffer-like products, loss of a single packet might lead to failure of audit to whole session. b. SAS is designed to collect and forward packets only. The complicated protocol analysis and audit are left to SAD which works off-line and wont impact the network performance at all.
