Performance considerations
The ring topology that is used to connect the stacked QRadar® Network Packet Capture appliances is designed to achieve high availability for continuous capture of data.
Each packet that is transmitted between the appliances includes extra data about the status of the stack. For example, this includes information about which stack node is storing data, and the status of the stack nodes. Depending on your environment, the additional data that is transmitted with each packet might result in capture performance that is less than 10 Gbps under certain circumstances.
For example, network traffic that consists of a high proportion of small packets over time might result in a lower capture rate. While this situation is not typical for most deployments, if under these circumstances, your deployment requires full 10 Gbps capture, it is recommended that the QRadar Network Packet Capture appliances are deployed stand-alone instead of using a stack.