Hi we are moving to a Netwitness 11 Packet only environment with no logs.
Do we still need an ESA?
I remember an ESA can support 30K EPS, but how does the translate to collecting packet meta. For example, do I need 1 ESA per 10Gbps of packet collection?
What is a good packet decoder / ESA ratio?