Properly sizing a Stealthwatch deployment is critical to ensuring network visibility without dropping flow records. Unlike traditional bandwidth monitoring, Stealthwatch sizing is primarily based on the volume of Flows Per Second (FPS) generated by your exporters (switches, routers, firewalls, and Flow Sensors).
Why Flows Per Second (FPS) Matters
Network hardware generates NetFlow, IPFIX, or sFlow records summarizing communication between endpoints. A single "flow" represents a unidirectional stream of packets sharing common characteristics (Source IP, Dest IP, Ports, Protocol). The Flow Collector (FC) has a hard limit on how many of these records it can ingest and process per second. If your network traffic generates 30,000 FPS but your collector is licensed for 20,000 FPS, you will experience data loss and visibility gaps.
How to Determine Your Flow Rate
If you have an existing tool, look for the "Flows Per Minute" or "Flows Per Second" metric. If you are planning a greenfield deployment, you can estimate FPS based on the number of users and active interfaces:
Campus Users: Typically generate 10–20 flows per second per user during peak activity.
Datacenter Servers: Can vary wildly, often 50–200+ FPS per server depending on application architecture.
Internet Edge: High volume of short-lived flows (DNS, HTTP) can cause FPS spikes.
Calculating Storage Requirements
Storage requirements for Stealthwatch depend on three variables: the Flow Rate (FPS), the Retention Period, and the Average Record Size.
The formula generally used is:
Storage = FPS × 86,400 (seconds/day) × Retention Days × Record Size (Bytes)
While NetFlow v5 records are static in size, NetFlow v9 and IPFIX are template-based. A safe estimate for modern telemetry with basic extensions is between 60 and 100 bytes per flow record.
Deduping and Flow Stitching
Keep in mind that Stealthwatch performs "deduplication" or stitching. If a flow passes through three routers, it may be reported three times. Stealthwatch attempts to stitch these into a single conversation. However, for sizing the Ingest capacity of a Flow Collector, you must count the raw flows arriving from all exporters, not the deduplicated conversation count.
function calculateStealthwatchSizing() {
// Get Input Values
var rawVolume = document.getElementById('sw_input_volume').value;
var unit = document.getElementById('sw_volume_unit').value;
var growthRate = document.getElementById('sw_growth_rate').value;
var years = document.getElementById('sw_planning_years').value;
var retentionDays = document.getElementById('sw_retention_days').value;
var recordSize = document.getElementById('sw_avg_flow_size').value;
// Validation
if (rawVolume === "" || isNaN(rawVolume)) {
alert("Please enter a valid flow volume.");
return;
}
// Convert strings to floats
rawVolume = parseFloat(rawVolume);
growthRate = parseFloat(growthRate) || 0;
years = parseFloat(years) || 0;
retentionDays = parseFloat(retentionDays) || 30;
recordSize = parseFloat(recordSize) || 80;
// 1. Normalize to FPS
var currentFPS = 0;
if (unit === 'fpm') {
currentFPS = rawVolume / 60;
} else {
currentFPS = rawVolume;
}
// 2. Calculate Growth
// Formula: Future = Current * (1 + rate/100)^years
var growthFactor = Math.pow(1 + (growthRate / 100), years);
var futureFPS = currentFPS * growthFactor;
// 3. Calculate Storage
// FPS * 60 * 60 * 24 = Flows Per Day
var flowsPerDay = futureFPS * 86400;
var totalBytes = flowsPerDay * retentionDays * recordSize;
// Convert to GB and TB
var storageGB = totalBytes / (1024 * 1024 * 1024);
var storageTB = storageGB / 1024;
// 4. Determine Recommended Tier (Heuristic based on common appliance tiers)
var tiers = [1000, 2500, 5000, 10000, 20000, 40000, 80000, 120000, 250000]; // Common FC capacities
var recommendedTier = "Custom / Multi-Node Cluster";
for (var i = 0; i < tiers.length; i++) {
if (futureFPS 250000) {
recommendedTier = "High Scale Cluster (UDP Director + Multiple FCs)";
}
// Formatting Helper
function formatNumber(num) {
return num.toLocaleString(undefined, {maximumFractionDigits: 0});
}
function formatStorage(gb) {
if (gb > 1000) {
return (gb / 1024).toFixed(2) + " TB";
}
return Math.ceil(gb).toLocaleString() + " GB";
}
// Display Results
document.getElementById('sw_result_display').style.display = 'block';
document.getElementById('sw_res_current_fps').innerText = formatNumber(currentFPS) + " FPS";
document.getElementById('sw_res_projected_fps').innerText = formatNumber(futureFPS) + " FPS";
document.getElementById('sw_res_storage').innerText = formatStorage(storageGB);
document.getElementById('sw_res_license').innerText = recommendedTier;
}