Wednesday, July 26, 2006

Making the Shoe Fit - CS-MARS Sizing

So you want a MARS box but don't know which one to buy? Cisco offers many options as to which appliance you can purchase and even has details online as to how each appliance is sized.



So as you can see the sizing is based upon events per second. So how excactly can you measure you events per second? Let me clarify this by showing you the devices we monitor and all together the events per second we generate. Here' our monitored devices:

4 x Windows Server
121 x Cisco 2811 IOS Routers
384 x Cisco 3750 IOS Switches
117 x PIX 506E Firewalls
2 x PIX 520 Firewalls
2 x PIX 515E Firewalls
7 x Cisco 3825/3845 Routers
2 x Cisco 4215 IPS 5.1 Sensors
6 x Unix Servers with Snort

So all together we have a relatively large infrastructure monitored by MARS. So events per second comes to what excactly? At peak usage during the day we generate about only 57 events per second. Which CS-MARS version do we run? We're currently running the 100e, which is capable of 3000 events per second! Wow... that's pretty damn powerful! We bought this size knowing that our infrastructure will soon include more servers along with NAC reporting to MARS. Hopefully this sizing overview helps when making the decision to purchase a CS-MARS appliance. If you ever need any help or recommendations, just ask!

50 comments:

Mike said...

Hey Jesmond,

Great question! What you're asking is completely possibly with MARS. I'll bring your question out to the main page of my blog and share how to manage Windows events. Give me a day to pull together an example for you.

-Mike

Anonymous said...

Hi Mike,

Do you have your routers configured to send Netflow?

-Thanks

Unknown said...

I'm blown away by the feature set of MARS and love it's ability to integrate devices from other vendors for centralized security event management.

From a network infrastructure perspective we're primarily a Cisco shop but we have a number of Snort IDS sensors deployed along with our Windows/Linux server farms.

With the CS-MARS-200-K9 a bit out of our reach the 100 and 100E sound like the systems of choice.

I'm curious, do you know how the hardware of the 100 and 100E differs? Is the event and netflow handling capability of the 100 available via license upgrade of teh 100E?

Regards,

Laurent Geyer
misc@085zehn.com

Anonymous said...

Hi Mike.... I think I found your blog too late.... I am doing my thesis to finish the university of events correlation... and of course, about CS-MARS.... I saw one post that you tell about the number of events per second.... and I need to know if you know where can I find those numbers for each device.....
All my thesis is teorical... so I never ever had the chance to put my hands on a CS-MARS.... if you could help me.... (if you have msn: davidmello81@hotmail.com)
Thanks a lot
David

Unknown said...

Mars Product Line

Mars 20
Events/Sec 500
NetFlows Flows/Sec 15,000
RAID Storage 120GB
Rack Size 1 RU

Mars 50
Events/Sec 1,000
NetFlows Flows/Sec 25,000
RAID Storage 120GB
Rack Size 1 RU

Mars 100e
Events/Sec 3,000
NetFlows Flows/Sec 75,000
RAID Storage 750GB
Rack Size 3 RU

Mars 100
Events/Sec 5,000
NetFlows Flows/Sec 150,000
RAID Storage 750GB
Rack Size 3 RU

Mars 200
Events/Sec 10,000
NetFlows Flows/Sec 300,000
RAID Storage 1TB
Rack Size 4 RU

Global Controller
Events/Sec N/A
NetFlows Flows/Sec N/A
RAID Storage 1TB
Rack Size 4 RU

Hope that helps, Great Blog...

Anonymous said...

Hey Mark, thanks for your answer, but what I was asking was about the other devices (eg. firewall, routers and etcs)... how can I measure how many EPS they send..... thanks in advance.

DVD said...

Sorry, Robert and not Mark :-) hehehe

Anonymous said...

Hello,
This is a great blog for CS-MARS. I would be installing one for the first time at my clients place.
Could I get in touch with you via email?
My email id is
mohan168@gmail.com
or
support@netplacetechnologies.com

Thanks

astroman said...

Really easy way to calculate EPS on the MARS appliance, to gauge baselining and peak usage:

Take the number of events fired, in a 24 hour period, and divide that by 86,400 (number of seconds in a day).

Example:

1,500,000 / 86,400 = 17.36 EPS

Anonymous said...

You can't possibly be running debug level logging on your hardware, and only be receiving that many EPS.

To suggest that you could potentially get by on a smaller MARS appliance would not be correct. The intent of pushing information to MARS to give it as much as possible. Step up the logging, and I believe your EPS would be significantly higher.

Anonymous said...

Calculating EPS by taking the overall events daily (or weekly or whatever) might be sometimes risky.

For example, if you're a law firm working 9:00 - 17:00, and you have 1,500,000 events a day, you think you are sufficient with a machine running up to 50EPS (the 20R).

However, true life is that you should calculate 1,500,000 / NumberOfActivityHours, in this case:

1,500,000 / (8hoursX60minutesX60seconds) = 1,500,000 / 28,800 = 52EPS

So, the 20R will NOT suffice, you need to go with the 20!!!

Anonymous said...

How can I tell how many events per second our MARS 100 is receiving?

Anonymous said...

Hi, just to find out, for an environment with 30 ASA5510 all with AIP10 modules.

What would be a good estimate sizing of CS MARS to support this requirement (30 ASA)(30 IPS)?

Unknown said...

Is there a formula that depends on the number of users, servers and security devices/softwares installed?

Anonymous said...

Hi Mike,

Could you help me with the following scenario:

I will have a central site (A site) and other five operational sites (B site). In average each site will have the following ITC infrastructure:
- 1 Catalyst 6500 (L3)
- 1 FWSM
- 1 IPS 2Gbps
- 1 Core switch (stack)
- 6 Distribution/Access switches
- NAC Clean Access Server
- 16 blade switches (inside blade enclosures)
- 1 Active Directory (and DNS/DHCP) server
- 1 AV Server (McAfee ePO)
- 60 servers for different applications (the majority for video)
- 120 users on site

Each site B will have 1500 small branches (near 8000 in total). In turn, each branch will have one Cisco ISR router and a 4Mbps ADSL link.

I am considering having Cisco MARS in the SOC to do all the security monitoring, identification and response of incidents, but I have the following questions:
- What type of deployment is better for this project?:
a) A central standalone MARS controller in the SOC, or
b) A central global controller in the SOC and a local controller in each site (one A and five B)
- How can I estimate the EPS at each site if they do not exist yet and I cannot measure anything?
- Does someone have data about EPS (average and peak) for real scenarios for each of the aforementioned infrastructure products?

Thank you very much
Best regards

Arturo Monroy

Sakul said...

Hi,

What if the actual eps exceeds the CS-MARS capacity (specially during peak traffic)?
Will CS-MARS buffer or discard the exceeding events?

Josh Gant said...

Hi Mike,

Are you logging acl drops, tcp and udp session creation from all those firewalls? This is very useful information to be logging to MARS and I doubt you could be doing that with such a small reported EPS. I have environments with a 10th of what you listed that are often over 200 EPS.

Anonymous said...

free sample pack of viagra viagra soft tabs viagra online stores where to buy viagra mexico viagra get viagra viagra overdose viagra facts viagra online uk viagra patent viagra strips buy cheap viagra online uk cialis super viagra viagra faq

Anonymous said...

Who knows where to ascertain a detach cardsharing server?
I bought a dreambox the other date, Setup CCcam. I've heard that Digital Vortex [url=http://cardsharing.devhub.com] Cardsharing[/url] Forum to be the most outstanding circumstances on the net to perceive cardsharing resources.
They've got the emu toolbox, place gbox-cccam.
With cardsharing being free, all needed is a free server.

Anonymous said...

Who knows where to espy a easy cardsharing server?
I bought a dreambox the other period, Setup CCcam. I've heard that Digital Vortex [url=http://cardsharing.devhub.com] Cardsharing[/url] Forum to be the most outstanding place on the reticle to see cardsharing resources.
They've got the emu toolbox, place gbox-cccam.
With cardsharing being free, all needed is a free server.

Anonymous said...

Who knows where to find a detach cardsharing server?
I bought a dreambox the other period, Setup CCcam. I've heard that Digital Vortex [url=http://cardsharingvortex.wetpaint.com/] Cardsharing[/url] Forum to be the get the better of ready on the reticle to perceive cardsharing resources.
They've got the emu toolbox, instal gbox-cccam.
With cardsharing being free, all needed is a free server.

Anonymous said...

Who knows where to espy a on the house cardsharing server?
I bought a dreambox the other period, Setup CCcam. I've heard that Digital Vortex [url=http://cardsharing.tumblr.com/] Cardsharing[/url] Forum to be the get the better of situation on the trellis-work to discover cardsharing resources.
They've got the emu toolbox, instal gbox-cccam.
With cardsharing being free, all needed is a free server.

Anonymous said...

Who knows where to ascertain a on the house cardsharing server?
I bought a dreambox the other date, Setup CCcam. I've heard that Digital Vortex [url=http://cardsharing.tumblr.com/] Cardsharing[/url] Forum to be the most outstanding circumstances on the reticle to find cardsharing resources.
They've got the emu toolbox, place gbox-cccam.
With cardsharing being free, all needed is a free server.

Anonymous said...

Virtual memory is something that I seem to be unable to ever have enough of. It's as if megabytes and gigabytes have become a permanent part of my every day existence. Ever since I bought a Micro SD Card for my DS flash card, I've been on the constant lookout for large memory at low prices. I feel like I'm going insane.

(Posted by Net10 for R4i Nintendo DS.)

Anonymous said...

Hello,

can anyone tell me which is the best counter strike guide ? :)...i found this one :

http://www.downloadzdb.com/Counter_Strike_Best_Guide

What do you rise up with primitively it ?

Thanx in advance

Sorry for my bad english :s

Anonymous said...

Hello,

can anyone tell me which is the best counter strike guide ? :)...i found this one :

http://www.downloadzdb.com/Counter_Strike_Best_Guide

What do you come up with upset it ?

Thanx in advance

Sorry for my bad english :s

Anonymous said...

Howdy,

When ever I surf on web I come to this website[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url]cs-mars.blogspot.com is filled with quality info. Do you pay attention towards your health?. Here is a fact for you. Research presents that about 90% of all USA grownups are either chubby or overweight[url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips].[/url] Therefore if you're one of these people, you're not alone. In fact, most of us need to lose a few pounds once in a while to get sexy and perfect six pack abs. Now next question is how you can achive quick weight loss? [url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips]Quick weight loss[/url] is really not as tough as you think. If you improve some of your daily diet habbits then, its like piece of cake to quickly lose weight.

About me: I am author of [url=http://www.weightrapidloss.com/lose-10-pounds-in-2-weeks-quick-weight-loss-tips]Quick weight loss tips[/url]. I am also health expert who can help you lose weight quickly. If you do not want to go under painful training program than you may also try [url=http://www.weightrapidloss.com/acai-berry-for-quick-weight-loss]Acai Berry[/url] or [url=http://www.weightrapidloss.com/colon-cleanse-for-weight-loss]Colon Cleansing[/url] for effortless weight loss.

Anonymous said...

hi

Anonymous said...

hi

Anonymous said...

Just popping in to say nice site.

Anonymous said...

9 Jan 2010 Your One-Stop Online Pharmacy in Malaysia: PharmacyMalaysia only provide the best range of products for you and your loved one.
When looking for an online pharmacy, by sure they display the VIPPS symbol. This signifies that they are following all the rules and regulations set forth
Order Cheap Drugs at Drugs-Pro! Our Pharmacy Online offer High Quality European Drugs! Satisfaction Guaranteed! Worldwide Shipping! Call us: 1-516-7171622.
Online Pharmacy from Canada, Buy generic medications. Worldwide Shipping, No Prescription Required, FDA Approved Drugs, Fast Delivery.
Read Online Chemist & Pharmacy Reviews, Price Comparison and Store Ratings. Compare Online Chemist & Pharmacy and buy from the best Australian stores at

[url=http://www.myhero.com/go/print.asp?hero=pending74308]Buy Glucophage Online In UK[/url][url=http://www.myhero.com/go/print.asp?hero=pending74300]Cheap Fosamax[/url][url=http://www.myhero.com/go/print.asp?hero=pending74713]Buy Viagra Online Without Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74188]Purchase Cipro[/url][url=http://www.myhero.com/go/print.asp?hero=pending74688]Cheap Topamax[/url][url=http://www.myhero.com/go/print.asp?hero=pending74735]Buy Voltaren Online Without Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74448]Generic Indocin[/url][url=http://www.myhero.com/go/print.asp?hero=pending74276]Purchase Epivir[/url][url=http://www.myhero.com/go/print.asp?hero=pending74629]Retin A Online[/url][url=http://www.myhero.com/go/print.asp?hero=pending74564]Buy Omnicef Online Without Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74134]Buy Bactrim Online[/url][url=http://www.myhero.com/go/print.asp?hero=pending74584]Purchase Plavix[/url][url=http://www.myhero.com/go/print.asp?hero=pending74644]Buy Septilin Online Without Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74021]Buy Abilify Online No Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74756]Buy Zithromax[/url][url=http://www.myhero.com/go/print.asp?hero=pending74573]Order Paxil[/url][url=http://www.myhero.com/go/print.asp?hero=pending74594]Buy Premarin Online Without Prescription[/url][url=http://www.myhero.com/go/print.asp?hero=pending74320]Buy Himcolin Online[/url][url=http://www.myhero.com/go/print.asp?hero=pending74659]Cheap Strattera[/url][url=http://www.myhero.com/go/print.asp?hero=pending74607]Generic Propecia[/url]

Unknown said...

sınırsız porno izle | sikiş | porno izle | gizli çekim sikiş | porno izle | canli sikiş | adult film | sikiş izle | şifalı bitkiler | şikiş izle | kara şimşek izleShipping Containers are strong, secure and weatherprooof and are available in a variety of lengths. This makes our containers ideal for high security storage & shipping

Anonymous said...

teacher dating recent graduate http://loveepicentre.com free dating site america

Anonymous said...

simply dropping by to say hey

Anonymous said...

[url=http://loveepicentre.com/][img]http://loveepicentre.com/uploades/photos/6.jpg[/img][/url]
jeremy dating tx [url=http://loveepicentre.com/taketour.php]cigar smoking women dating[/url] free dating sites for wifes
serious american dating [url=http://loveepicentre.com/]free chatting and dating[/url] escort dating orlando
radioactive dating process [url=http://loveepicentre.com/map.php]arkansas christian dating[/url] who is norman kiken dating

Anonymous said...

[url=http://loveepicentre.com/][img]http://loveepicentre.com/uploades/photos/9.jpg[/img][/url]
health and dating [url=http://loveepicentre.com/taketour.php]sleep apnea dating[/url] free dating sites for indianapolis indiana
fun guy msf dating long term [url=http://loveepicentre.com/faq.php]meet columbia women dating service cali[/url] stefan deutsch on love computer dating
wellington indian woman dating [url=http://loveepicentre.com/map.php]dating sim girl[/url] speed dating nyc

Anonymous said...

[url=http://loveepicentre.com/testimonials.php][img]http://loveepicentre.com/uploades/photos/7.jpg[/img][/url]
dana dearmond dating dan tosh [url=http://loveepicentre.com/testimonials.php]free dating in austraila[/url] pros and cons of single dating
christian dating questions [url=http://loveepicentre.com/taketour.php]free online dating site in usa[/url] online free dating games
speed dating in johnson city [url=http://loveepicentre.com/]pantyhose fetishe dating[/url] is sophia bush dating anyone

Anonymous said...

[url=http://loveepicentre.com/][img]http://loveepicentre.com/uploades/photos/10.jpg[/img][/url]
fishes dating [url=http://loveepicentre.com/articles.php]irish-american dating[/url] utopia herpes dating
steve dating brea [url=http://loveepicentre.com/map.php]sexy coed dating[/url] dating a leo
safe dating tips and rules [url=http://loveepicentre.com/map.php]calgary dating service free[/url] team dating

Anonymous said...

ebook mrr boating http://audiobookscollection.co.uk/fr/Ty-Cobb-Baseball-Superstars/p212919/ gavan mahmud ebook [url=http://audiobookscollection.co.uk/fr/Mercy/p203054/]ebook the octopus effect[/url] how to reference an ebook

Anonymous said...

glaucoma ebook ferr down http://audiobooksplanet.co.uk/fr/Maria-Goeppert-Mayer-Physicist/p177042/ em griffin ebook [url=http://audiobooksplanet.co.uk/de/The-Information-A-History-a-Theory-a-Flood/p28945/]ebook photoshop[/url] forex market ebook

Anonymous said...

the holographic universe michael talbot ebook http://audiobooksworld.co.uk/Mark-Gladwin/m82898/ free erotica ebook [url=http://audiobooksworld.co.uk/Repair/c2303/]information and library science ebook[/url] vb script ebook

Anonymous said...

ghd hair straightener dndgxzyq ghd australia wvozjtqs ghd hair straighteners icoinlqc

Anonymous said...

[url=http://certifiedpharmacy.co.uk/products/dulcolax.htm][img]http://onlinemedistore.com/7.jpg[/img][/url]
nuclear pharmacy jobs careers http://certifiedpharmacy.co.uk/products/omnicef.htm california state boards of pharmacy [url=http://certifiedpharmacy.co.uk/products/grifulvin-v.htm]pharmacy purchasing job opportunities[/url]
pre registration pharmacy interview questions http://certifiedpharmacy.co.uk/categories/women-s-health.htm canadian pharmacy and levitra [url=http://certifiedpharmacy.co.uk/categories/stop-smoking.htm]stop smoking[/url]
steroids pharmacy http://certifiedpharmacy.co.uk/products/tulasi.htm antique pharmacy book [url=http://certifiedpharmacy.co.uk/products/viagra-jelly.htm]fun pharmacy facts[/url]
rite aid pharmacy massachusetts avenue cambridge http://certifiedpharmacy.co.uk/catalogue/l.htm minnesota state board of pharmacy [url=http://certifiedpharmacy.co.uk/products/cleocin.htm]cleocin[/url]

Anonymous said...

[url=http://englandpharmacy.co.uk/products/azulfidine.htm][img]http://onlinemedistore.com/2.jpg[/img][/url]
jupiter pharmacy http://englandpharmacy.co.uk/products/provera.htm tesco pharmacy product [url=http://englandpharmacy.co.uk/products/elavil.htm]florida pharmacy tech[/url]
purchase zantac pharmacy http://englandpharmacy.co.uk/products/vitamin-c.htm retail pharmacy inventory law [url=http://englandpharmacy.co.uk/products/alavert.htm]alavert[/url]
karma huffman universtiy of iowa pharmacy http://englandpharmacy.co.uk/products/dramamine.htm mexican pharmacy elivel [url=http://englandpharmacy.co.uk/products/mobic.htm]canada job pharmacy technician[/url]
pharmacy across the pond http://englandpharmacy.co.uk/products/prevacid.htm pharmacy merchant forum [url=http://englandpharmacy.co.uk/products/cipro.htm]cipro[/url]

Anonymous said...

[url=http://englandpharmacy.co.uk/products/lisinopril.htm][img]http://onlinemedistore.com/10.jpg[/img][/url]
pharmacy school graduate offers http://englandpharmacy.co.uk/products/mxman.htm otway herbs pharmacy [url=http://englandpharmacy.co.uk/categories/anti-diabetic.htm]pharmacy by san francisco airport[/url]
ivy league pharmacy school http://englandpharmacy.co.uk/products/apcalis-sx.htm drug store pharmacy online [url=http://englandpharmacy.co.uk/products/topamax.htm]topamax[/url]
training for pharmacy technicians http://englandpharmacy.co.uk/products/hangoff-helper.htm medco pharmacy technician requirements [url=http://englandpharmacy.co.uk/products/procardia.htm]odon pharmacy indiana[/url]
july email pharmacy chat call face live southwestmedicalgroup http://englandpharmacy.co.uk/products/floxin.htm pharmacy school information [url=http://englandpharmacy.co.uk/products/rogaine-5-.htm]rogaine 5 [/url]

Anonymous said...

I think that is one of the most significant info for me.
And i'm satisfied studying your article. But wanna statement on few normal issues, The site taste is wonderful, the articles is really nice : D. Just right task, cheers

My page - buy quantrim

Anonymous said...

phonechat dating http://loveepicentre.com/taketour/ latina dating in orange county
dating sites california [url=http://loveepicentre.com/map/]online dating sites belleville on canada[/url] christian dating standerds
latest free dating sits [url=http://loveepicentre.com/success_stories/]lesbian dating games[/url] candy dating [url=http://loveepicentre.com/user/carlosmoore1123/]carlosmoore1123[/url] discrete dating

Anonymous said...

free flirts xxx love dating http://loveepicentre.com/testimonials/ japanese culture dating
mixed dating [url=http://loveepicentre.com/testimonials/]tera roy secure personals dating site[/url] dating internet research
dating free online totally [url=http://loveepicentre.com/contact/]dating in magazines[/url] dating marriage mexico [url=http://loveepicentre.com/user/Samuel/]Samuel[/url] philippine ladyboy shemale dating

Anonymous said...

Successful the actual Natіοn's lottery needs to be just about every ones fantasy, which states dollars are not able to acquire happiness? This type of online game involves the circle associated with on the web slots which might be related collectively in an electronic format.

Also visit my homepage :: online Casino Golden cherry

Anonymous said...

The геasοn ωhу iѕ observеd becauѕe improve in option of brοaԁband arоund the woгld.

Ӏ unԁerstand to get а fact thаt аdminіѕtrаtoгs whеге by We
pгoveԁ helpful ωеre being consсіous
of the situation, nеveгtheleѕs ѕο long as the actual kitchen table manufactured
income tοtal, thesе folks werе too sluggish іn order to worry аbout one paгticulаr gentlemаn earnіng рrofits
about it.

my web рage; Homepage