Skip to content
ENExplore Calculators

IDS Capacity Calculator

Size passive IDS sensors from mirrored traffic: packet rate, sensors required and full-packet-capture storage.

About IDS Capacity Calculator

A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window. An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.

Formula

IDS Capacity

pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention.

pps
Packets per second the sensor must parse
capture share
Percentage of the stream written to disk as pcap

Worked example

With the default values below, IDS Capacity Calculator returns Sensors Required of 1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Mirrored (SPAN/TAP) trafficaccepts 0.01–1,000 Gbps
4 Gbps
Average packet sizeaccepts 64–9,000 bytes
800 bytes
Rated capacity per sensoraccepts 10,000–100,000,000 pps
3,000,000 pps
Share of traffic kept as full packet captureaccepts 0–100 %
5 %
Packet capture retentionaccepts 0–365 days
7 days

Results

Sensors Required
1
Mirrored Packet Rate
625,000 pps
Sensor Utilisation
20.8%
Packet Capture Storage
13.75 TiB
Capture Written per Day
1.96 TiB

Step by step

  1. 1Values used
  2. 2IDS Capacity
  3. 3Sensors Required= 1
  4. 4Mirrored Packet Rate= 625,000 pps
  5. 5Sensor Utilisation= 20.8
  6. 6Packet Capture Storage= 15,120,000,000,000.00
  7. 7Capture Written per Day= 2,160,000,000,000.00

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is IDS Capacity calculated?

pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention. A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window.

Why does IDS Capacity matter?

An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.

What values do I need to enter?

This calculator takes 5 inputs: Mirrored (SPAN/TAP) traffic, Average packet size, Rated capacity per sensor, Share of traffic kept as full packet capture, Packet capture retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does small-packet traffic hurt IDS sensors so much?

Per-packet cost is roughly fixed: header parsing, flow lookup and stream reassembly happen once per packet regardless of size. At 64-byte packets the same 4 Gbps becomes about 7.8 million pps instead of 625,000, so a sensor sized on bandwidth alone is over ten times undersized.

Related Calculators

IDS Capacity Calculator – Calculate Sensors Required