Local and Standalone Controllers
No difference in hardware or software exists between a local controller and a standalone controller. A standalone controller is a MARS-20R, MARS-20, MARS-50, MARS-100e, MARS-100, MARS-110R, MARS-110, MARS-200, or MARS-210 that operates as a complete CS-MARS system. An LC is the same model that is configured to communicate with a global controller.
Table 3-1 shows the capabilities of each of the CS-MARS local and standalone controllers.
Table 3-1 CS-MARS Local and Standalone Controllers
Table 3-1 shows the capabilities of each of the CS-MARS local and standalone controllers.
Table 3-1 CS-MARS Local and Standalone Controllers
|
Model |
NetFlow Events per Second |
Storage |
RAID Level |
Size, Rack Units (RU) |
|
|
MARS-20R |
50 |
1500 |
120 GB |
None |
1 |
|
MARS-20 |
500 |
15,000 |
120 GB |
None |
1 |
|
MARS-50 |
1000 |
30,000 |
240 GB |
0 |
1 |
|
MARS-100e |
3000 |
75,000 |
750 GB |
1+0 |
3 |
|
MARS-100 |
5000 |
150,000 |
750 GB |
1+0 |
3 |
|
MARS-110r |
4500 |
75,000 |
1.5 TB |
1+0 |
2 |
|
MARS-110 |
7500 |
150,000 |
1.5 TB |
1+0 |
2 |
|
MARS-200 |
10,000 |
300,000 |
1 TB |
1+0 |
4 |
|
MARS-210 |
15,000 |
300,000 |
2 TB |
1+0 |
2 |
Each MARS appliance fits into a 19-inch rack. They each run a hardened installation of Linux and have two Ethernet interfaces.
When determining which MARS appliance fits your needs, you should closely study the information presented in Table 3-1. MARS appliances are sized by the number of events that that particular model can process without dropping information. The number of devices that can send events to the MARS appliance is unlimited. However, in a flood condition, such as when a network worm has infected your network, or when your network is the target of a denial of service (DoS) attack, you will see a significant spike in numbers of events that your network and security devices or software is sending to the monitoring console. As you increase the number of devices that report to MARS, the potential for event traffic also increases.
Additionally, you need to consider the available storage on each appliance, especially as you determine the length of time that security incidents and events need to be immediately available on the MARS appliance. This time period varies from customer to customer; it also varies according to what industry your company is in and which regulatory requirements you need to meet. Take note that the MARS-100 and larger appliances all have Redundant Array of Independent Disks (RAID) arrays to decrease the chance of a hard drive failure causing loss of data or functionality. These appliances also have hot-swappable hard drives.
Continue reading here: Determining Your Events per Second
Was this article helpful?