3 Replies Latest reply on Nov 21, 2012 11:40 AM by aaron4288

    How many devices can we add to a single ESM

      How many Nitro devices can we add to a single ESM system. Are there any limit in number for each device type, e.g. 16 for Receivers, 4 for ELM.

      Is it model dependent? If it is, could you provide devices number for ETM-5600.


      I can't find information for this question in knowledge base. Really sorry if it's already there.


      Best regards,

      Parinya Ekparinya

        • 1. Re: How many devices can we add to a single ESM

          QA has seen some limits upwards of 255 devices but the the general rule is as long as your total devices event rates are not exceeding your limits of your ESM then you can have as many as you want/need.


          From the Mcafee website:


          Hardware SpecificationsETM-X6ETM-X4ETM-6000ETM-5600
          Collection Rates300,000 events per second1150,000 events per second170,000 events per second150,000 events per second1
          Analytical PerformanceLess than 10 seconds2Less than 30 seconds2Less than 1 minute2Less than 3 minutes2
          Local Storage14 TB3 + 3.2 TB Flash14 TB3 + 800 GB SSD14 TB38 TB3
          • Based on typical network environments using average event and flow aggregation.
          • Indicates the average response time to generate a monthly report consisting of all events that occurred over a period of 30 days.
          • Represents usable event and flow storage, after RAID configuration.
          • 2. Re: How many devices can we add to a single ESM

            For example, if I got ETM-5600 and I want to add 8 of ERC-1250.

            ETM-5600 can handle 50,000 EPS.

            ERC-1250 can handle 5,000 EPS. 8 of ERC-1250 will be 40,000 EPS in total.


            So in above case, it would be fine since EPS is still not overwhelm ESM, correct?


            Thank you very much for information.


            Best regards,

            Parinya Ekparinya

            • 3. Re: How many devices can we add to a single ESM

              Theoretically that should work. But those numbers are in ideal conditions. Out of sync data and correlation can cause the system to perform differently. In most situations yes you will be fine but as a note those are ideal situational numbers.

              1 of 1 people found this helpful