Performance Levels Based on Flow Inspection Levels
SUMMARY Flow inspection levels are cumulative, and each level collects more data than
the level before it. You must configure the flow inspection level to suit the flow rate that you
want to achieve.
System performance varies based on the exact configuration and tuning
of the system components. It is influenced not only by hardware, but also factors such as the
search, extraction criteria, and the amount of network data.
| Flow Inspection Level | 1901 appliance | 1910 appliance | 1920 appliance (1) | 1940 appliance(1) |
|---|---|---|---|---|
| Basic | ~ 4 Gbps | ~ 10 Gbps | ~ 10 Gbps | ~ 10 Gbps |
| Enriched | ~ 3 Gbps | ~ 3 Gbps | ~ 6 Gbps | ~ 6 Gbps |
| Advanced | ~ 1.2 Gbps | ~ 1.2 Gbps | ~ 2.5 Gbps | ~ 2.5 Gbps |
| (1) Supports appliance stacking. | ||||
Scaling Performance by Stacking Appliances
To achieve higher flow rates, you can stack some QRadar Network Insights appliances to distribute data processing across multiple Napatech cards and CPUs.
The following appliance types can be stacked, with up to four appliances in each stack.
- QRadar Network Insights 1920 (Type 6200)
- QRadar Network Insights 1940 (Type 6600)
In a stacked configuration, the performance scales linearly according to the number of appliances in the stack. For example, a stack with three appliances can achieve up to 3x the performance, depending on the flow inspection level.
For more information, see QRadar Network Insights Appliance Stacking.