IBM QRadar Network Packet Capture connections

If you are using IBM QRadar Network Packet Capture to capture packet data, you can extend the storage by connecting multiple appliances together in a ring topology to create a stack.

The stack allows the distribution of capture data across each of the connected appliances. It can connect up to 16 devices, but appears and behaves like a single entity that captures data from one TAP of a single 10GB port.

The Stack Controller is the appliance that receives the traffic that is being monitored, also known as the TAP point. The Stack Controller manages the overall configuration for the stack, therefore, there can be only one controller in each stack. The Stack Node is the appliance that is used as storage for the capture data. You can have up to 15 nodes in a stack.

Image shows a QRadar Console with a Forensics Processor managed host, connected to multiple QRadar Network Packet Capture appliances in a stacked configuration.

When you configure the stack in QRadar, add only the IP address for the stack controller. Do not add the IP addresses for each of the stack nodes.