Maxium events per second of a IDSM2

[gpoer]

Hello!

We are trying to size a Cisco MARS. Under perfect conditions what is the maxium events that can be generated by an IDSM2?

thanks for the help,

Geoff

[umedryk]

This is more subjective to your network and also what you define as suspicious traffic.

[gpoer]

Thanks for the response!

Actually I disagree. Under perfect conditions what is the number that depicts how fast the device can spit out events. As an example, if the devices can monitor 600 megs of traffic, how many events can it analysis before it drops packets.

While, I will give you that with normal traffic that number is dependent on how deep in the packet the signature looks. However, I am looking at perfect conditions, meaning simple signatures that may never leave the 1st 64 bytes of the packet. I want to know what is the maximum number of events I can expect from the device per/sec if every packet matched the most simple signature.

Geoff