topic Re: Interfaces speeds calculation | Stealthwatch in Security Analytics

Interfaces speeds calculation | Stealthwatch

eth0-learner — Thu, 01 Aug 2024 03:42:02 GMT

In my organization we are using stealth watch for NW monitoring.

I'm new on this tool

There's a confusion regarding interface speeds

At interfaces tab it shows the if-xxx link speed is 1Gbps is the maximum bandwidth the interface is capable of

but at the same time Max traffic is shown as 54 Gbps

How is it possible and how does it calculate.

In a flow as well how it calculates transfer speed , its not accurate all the time or is it ?

Re: Interfaces speeds calculation | Stealthwatch

rocedar — Thu, 01 Aug 2024 12:55:02 GMT

Hi eth0-learner,

By default SNA (StealthWatch) treats all interfaces as 1 Gig unless it knows better. Setup SNA so it can poll the various exporters (switches/routers/firewalls) with SNMP. Then SNA will have more detailed interface information. From SMC: Configure > Exporters > Exporter SNMP Profiles

Re: Interfaces speeds calculation | Stealthwatch

eth0-learner — Fri, 02 Aug 2024 04:39:21 GMT

Hi,

Thanks for your response. I will check that out.

I've sometimes seen flows containing speeds of 500 Gbps which is way beyond.

500 GB of data sent within a second sounded odd. Even-though SNA does flow stitching it is possible the total data might amount to 500 GB but the transfer speed doesn't sound realistic.

What could have caused it ...

Thanks,

Tony