Note: This guide is provided as a best effort to better help users understand the potential impact running multiple clients with TETRA, SPERO, ETHOS, DFC and SHA256 Lookups enabled and their bandwidth usage. The sizes in these guides are subjected to fluctuation. Units are expressed in Bytes (B), Gigabytes (GB) and Kilobytes (KB).
Quick Overview of TETRA on AMP for Endpoints
To enable TETRA and adjust settings go to Advanced Settings > TETRA in your policy.
Please see the AMP for Endpoints User Guide – Chapter 4 for more information on TETRA here: https://console.amp.cisco.com/docs
TETRA AV Signature Bandwidth Consumption
TETRA requires a minimum of 1GB of storage space per endpoint. Please see the chart below:
| 500MB – 550MB |
Initial TETRA Signature Download after installing a TETRA enabled connector |
Only downloaded once as the base definition set. |
| ~ 1MB to 8MB |
Incremental Signature Updates
|
~ 4 to 8 updates are pushed per day.* |
* Note: Depending on the Content Update Interval configured in the policy under Advanced Settings > TETRA will affect how often these are downloaded and thus bandwidth usage within the environment. Automatic Content Updates must be enabled to receive updates.
Quick Overview of ETHOS, SPEROS, DFC and SHA256 Lookup
ETHOS is the Cisco file grouping engine.
SPERO is the Cisco machine-based learning system.
Device Flow Correlation (DFC) allows you to monitor network activity.
SHA256 Lookup Files and applications are hashed and sent to the cloud for disposition lookup and cached.
Please see the AMP for Endpoints User Guide – Chapter 4 for more information on these here: https://console.amp.cisco.com/docs
ETHOS, SPEROS, DFC and SHA256 Lookup Bandwidth Consumption
Since these engines use minimal bandwidth.
Expected Average Client generates roughly 54 queries per day per client.
Considerations
Take care of WAN links and AMP installation in locations that have limited bandwidth. Deploying many endpoints at one time could impact availability to other network services.
TETRA
If installing into a location that has bandwidth concerns it may be worth installing a local TETRA Update Server as needed to lessen the demand on the WAN up-link. The TETRA server will act as a local network location for your endpoints to retrieve the necessary updates. This will drastically reduce bandwidth consumption over the WAN link.
Please see AMP Update Server Configuration Steps here: https://www.cisco.com/c/en/us/sup-port/docs/security/amp-endpoints/213237-amp-tetra-on-prem-server-configuration-s.html
ETHOS, SPEROS, DFC and SHA256 Lookup
Unless the bandwidth is extremely limited these engines do not need to be considered as their demand on the network is very limited. The expected traffic volume for a 5,000 Endpoint environment is ~139MB per day.
