AnsweredAssumed Answered

ESA in a packet only environment.

Question asked by David Waugh on Mar 22, 2019
Latest reply on Apr 1, 2019 by John Kisner

Hi we are moving to a Netwitness 11 Packet only environment with no logs.

Do we still need an ESA?

 

I remember an ESA can support 30K EPS, but how does the translate to collecting packet meta. For example, do I need 1 ESA per 10Gbps of packet collection?

 

What is a good packet decoder / ESA ratio?

Outcomes