Abt IDS MC and Security Monitor

[ben78ang]

hi,

In the website, it states the both these 2 modules can support about 300 sensors.

Is it more then 300 or less than 300?

What is ideally in reality a reasonable number that can be supported without delay/lag? Base on what kind of network/sensor alert statistics?

[scoclayton]

Good question but tough question to answer. 300 sensors is a "ballpark" figure we came up with based on the "normal" amount of alarms and config size that most people have. Your mileage may vary if you have sensors that generate a lot of alarms or have sensor configs that are abnormally large. Sorry to be so vague but if I were you, I would err on the side of having less sensors than more reporting to a single VMS box. Hope this helps.

Scott

[ben78ang]

Hi Scott,

thx for quick reply.

Well, this is tough to put forward to(for example) management level.

To state a number like 300, but telling pp its are to justify. Unless there are testimonies from companies with 300 sensors to 1 VMS to justify or any real statistic that can be referenced.

From other IDS that i had yet seen, have not dared put a number on it. especially 300 for a seurity monitor enterprise level. This can kill off competition if can prove, but may be a backlash if can't.

BTW, what would "normal" amount of alarms and config size be? any statistics?

So can Cisco provide statisics of acceptable alarm traffic that the Security monitor can handle per given period?

thx, Ben