Size passive IDS sensors from mirrored traffic: packet rate, sensors required and full-packet-capture storage.
A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window. An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.
IDS Capacity
pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention.
pps = mirrored bits ÷ (packet size × 8); sensors = ceil(pps ÷ sensor rated pps); storage = mirrored bytes per day × capture share × retention. A passive sensor is limited by how many packets it can decode per second, not how many bits arrive, so convert mirrored bandwidth into a packet rate using your average frame size. Full packet capture storage then follows directly from the byte rate, the fraction you choose to keep and your retention window.
An oversubscribed SPAN port drops packets silently — the IDS reports no alerts and looks healthy, while the traffic that mattered was never seen.
This calculator takes 5 inputs: Mirrored (SPAN/TAP) traffic, Average packet size, Rated capacity per sensor, Share of traffic kept as full packet capture, Packet capture retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Per-packet cost is roughly fixed: header parsing, flow lookup and stream reassembly happen once per packet regardless of size. At 64-byte packets the same 4 Gbps becomes about 7.8 million pps instead of 625,000, so a sensor sized on bandwidth alone is over ten times undersized.