stealthwatch flow rate license

[mina.zeinali]

I have a problem with flow rate license ordering. I cant find a good document or ordering guide for this license. I have read in stealthwatch datasheet that flow rate license defines the volume of flows that may be collected and is licensed on the basis of flows per second. but i cant understand part number description; for example “L-ST-FR-3Y-S8 : cisco stealthwatch flow rate 3 YR subs. 100.000-249.999” Is this the number of flows? Do I bave to order one license for every flow or one license for every 100.000 flows?

I have another question too : L-ST-FR-3Y-S8 is $11 and L-ST-FR-3Y-S1 is $91. Is this not strange? this is normal when the number of flows is increased, the price is higher. but here it is inverse.

I would appreciate if anyone could help me.

[mpriebe]

Hello - you need one flow rate license per every flow being processed by the flow collector.  The S8 in L-ST-FR-3Y-S8 is referring to band 8 of the  licensing model, which is 100k to 249.9999k flows.  S1 is 100-499 flows.  So it is a cheaper price for more flows as you thought it should be.

Hope that helps!

[Daniel Lucas]

Is there a document with this information?
So if the L-ST-FR-3Y-S1 part number is for 100-499 flows/sec - does that mean if I need 200 flows/sec that I need to buy 200 quantity of L-ST-FR-3Y-S1, or just 1 quantity?

[Marvin Rhoads]

You buy the quantity equal to the number of flows per seconds you need to support.

When your VAR enters it into the Cisco ordering system (CCW), they start with L-ST-FR-LIC= part number / SKU. They are then required to enter to number of flows per second needed and the term of the subscription.

That will result in something like this:

[cmoralesh83]

How to size the correct amount of flows?

[kyoshiik]

The most accurate way is to deploy Stealthwatch in the network and check UI. We offer PoV(Proof of Value) in the actual network. Please contact your vendor to proceed PoV or partner helpdesk.

After monitoring actual network traffic, you can see how many FPS do you need at that network.

Web UI: Go to FlowCollector WebUI and you can see FPS at bottom of the top page.

Java UI: Ctrl+L and click FlowCollectionLicenseReport to see FPS.

[Rajeshhirani5527]

The rule of thumb is to cater for 3 flows per active IP per second. 

[CSCO12550173]

hi, i have a question what happens when you exceeded the limit of the license

stealthwatch stops to records the flows that pass the limit?

thanks for the help, best regards

[kyoshiik]

FC continues to record Flow data after exceeding license, SMC just shows a warning with no functional limitation.

However, you need to purchase an extra license to cover them and Cisco has the possibility to change this specification in the future. If you deliberately do nothing to purchase for exceeding license, TAC can refuse the support case.