IDS Capacity Calculator
Size passive IDS sensors from mirrored traffic: packet rate, sensors required and full-packet-capture storage.
Inputs
Sensors Required
1
Mirrored Packet Rate
625,000pps
Sensor Utilisation
20.8%
Packet Capture Storage
13.75 TiB
Capture Written per Day
1.96 TiB
Step by step
Values used
Mirrored (SPAN/TAP) traffic = 4 Gbps; Average packet size = 800 bytes; Rated capacity per sensor = 3,000,000 pps; Share of traffic kept as full packet capture = 5 %; Packet capture retention = 7 days
IDS Capacity
pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention.
Sensors Required
= 1
Mirrored Packet Rate
= 625,000 pps
Sensor Utilisation
= 20.8
Packet Capture Storage
= 15,120,000,000,000.00
Capture Written per Day
= 2,160,000,000,000.00
How it works
A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window. An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.
Formula
IDS Capacity
pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention.
- pps
- Packets per second the sensor must parse
- capture share
- Percentage of the stream written to disk as pcap
Frequently Asked Questions
How is IDS Capacity calculated?
pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention. A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window.
Why does IDS Capacity matter?
An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.
What values do I need to enter?
This calculator takes 5 inputs: Mirrored (SPAN/TAP) traffic, Average packet size, Rated capacity per sensor, Share of traffic kept as full packet capture, Packet capture retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does small-packet traffic hurt IDS sensors so much?
Per-packet cost is roughly fixed: header parsing, flow lookup and stream reassembly happen once per packet regardless of size. At 64-byte packets the same 4 Gbps becomes about 7.8 million pps instead of 625,000, so a sensor sized on bandwidth alone is over ten times undersized.
You might also need
- Packet Inspection Capacity CalculatorCommonly used together
- IPS Throughput CalculatorCommonly used together
- Threat Detection Rate CalculatorCommonly used together
- SSL Inspection CalculatorAlso in Network Security
- NAT Session CalculatorAlso in Network Security
- DDoS Capacity CalculatorAlso in Network Security