How can I figure out the link speed needed between RSA Netwitness and log sources that gives?

[HaithamAbuHejle]

Dear ,

How can I figure out the link speed needed for a link between RSA Netwitness and log sources which give 500 events per second??

Please help asap.

[DaveGlover]

You could use something like the following.

1 device sending at 500eps and not knowing the event source let's use a size of 450 bytes per message.

We would multiple the 450*500 which gives us 225,000 bytes or 1.8 Megabits on the wire.

This would be the bandwidth consumption used to send those logs.

I made a lot of assumption here, but this is how I would go about calculating the required bandwidth

Hope this helps

Dave

[HaithamAbuHejle]

Hi Dave,

I need a confirmed or at least almost confirmed size of the event, is 450 bytes almost confirmed?

I need this in order I make official decision in making a data link between our RSA SIEM and a client (log source).

please advise.

Haitham

[DaveGlover]

Haitham

I was using 450 as a most common size. However the size will change considerably with the event source. For example a Cisco ASA message is about 160bytes and a Windows Message around 600-700 and a IIS message can be over 1k.

I would need to know the devices that you are sending from to make a more estimated guess. If these device types are already sending into NW then you could use the reporting engine to give you a much closer estimate

You could run a report on event size.. and then divide by the number of events received for a given time

Dave

[HaithamAbuHejle]

The log sources are the below:

- Cisco ASA.

- Cisco Firepower with snort.

- F5 Big-IP ASM v13.

- Microsoft Domain Controller.

Haitham 

[DaveGlover]

Haitham

The log sources are the below:

- Cisco ASA. ->about 160 bytes

- Cisco Firepower with snort. 400-600 bytes

- F5 Big-IP ASM v13. 300-500

- Microsoft Domain Controller. 500-800 bytes

If you use a base of 700 bytes *500 EPS gives you about 350k bytes and then convert the to megabits is about 2.8 megabits on the wire

Again this is an estimation. But should be pretty close

Dave