topic Re: Stealthwatch sizing in Security Analytics

Stealthwatch sizing

SIMMN — Fri, 02 Dec 2022 20:00:22 GMT

How do you typically size a Stealthwatch solution? Based on the number of flows, right? But what would be the most effective way to estimate the number of flows?

Cisco does provide the Flows Per Second Estimator tool but I am not entirely sure how to use it...For example, Under device category: Small (100), Medium (200), Large (400), what do the numbers mean, the device's FPS? If so, I would have to login to the device to get the number, right? If I have 100 switches, I would have to login to all 100 to get the FPS from each?

Looking for sizing suggestions.

Re: Stealthwatch sizing

lohan — Fri, 09 Dec 2022 09:08:45 GMT

Hi,
In the Flows Per Second Estimator tool, it is a Approximate data, and yes the numbers mean device' FPS.
If you want a really detailed data, you may download a 90-day free trial version to have a real test.
For example, you can watch how much FPS happening in one switch while monitor how many traffic this switch send out to calculate a matching proportion.
Otherwise, I'm afraid there is no way to calculate a specific number for all 100 switches.

In another way, if you warried about the cost about purchasing how many license,
you can purchase the license refer to Flows Per Second Estimator tool first, and purchase further if it is not enough to use.

May this answer can help.
Thanks.

Re: Stealthwatch sizing

SIMMN — Fri, 09 Dec 2022 13:35:39 GMT

Okey, thanks for the info.