Netflow Baselining

Unanswered Question
May 22nd, 2008
User Badges:

According to the MARS user guide "After being inserted into a network, MARS studies the network usage for a full week, including the

weekend, to determine the usage baseline. Once the baseline is determined, MARS switches to detection


How does one know when MARS swicthes to detection mode?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (1 ratings)
pmccubbin Thu, 05/22/2008 - 09:07
User Badges:
  • Silver, 250 points or more

Hi Niall,

I have been asked about this countless times by my customers. At the moment there is no way to tell when a MARS box has changed from baselining the network to detection mode.

All I can tell you is that I have asked Cisco to add it to their list of Product Enhancement Reequests.

Hope this helps.



pmccubbin Fri, 05/23/2008 - 06:54
User Badges:
  • Silver, 250 points or more

You are welcome.

Thanks for posting to this forum and not one of the other Security forums. There are so many Cisco Security products I'm hoping that this new forum will allow us to focus our efforts and not have to search multiple forums for answers. It also takes the guess work out of where to post a question.




This Discussion