Performance levels based on QRadar Network Insights flow inspection levels

Flow inspection levels are cumulative and each level collects more data than the level before it. You must configure the flow inspection level to suit the flow rate that you want to achieve.

Table 1. Performance based on flow inspection levels
Flow Inspection Level	1901 appliance	1910 appliance	1920 appliance ⁽¹⁾	1940 appliance⁽¹⁾
Basic	~ 4 Gbps	~ 10 Gbps	~ 20 Gbps	~ 20 Gbps
Enriched	~ 4 Gbps	~ 5 Gbps	~ 10 Gbps	~ 10 Gbps
Advanced	~ 1.2 Gbps	~ 1.2 Gbps	~ 2.5 Gbps	~ 2.5 Gbps
⁽¹⁾ Supports appliance stacking.

These performance numbers are based on tests performed against the following QRadar Network Insights M6 appliances running IBM QRadar 7.5.0 Update Package 6.

IBM QRadar Network Insights 1901 (MTM 4563-F8Y)
IBM QRadar Network Insights 1910 (MTM 4563-F7Y)
IBM QRadar Network Insights 1920 (MTM 4563-F5F)
IBM QRadar Network Insights 1940 (MTM 4563-F6G) (6600 and 6610 configuration)

Performance in your environment may vary depending on the following factors:

The inspection level that is configured.
The type of hardware that is used.
The type of network traffic that is observed, including file content and protocols that are inspected.

Scaling performance by stacking appliances

To achieve higher flow rates, you can stack some QRadar Network Insights appliances to distribute data processing across multiple Napatech cards and CPUs.

The following appliance types can be stacked, with up to four appliances in each stack.

QRadar Network Insights 1920 (Type 6200)
Stacking uses 2 of the 4 available ports on the NIC card, so even when stacked, the maximum throughput cannot exceed 20 Gbps.
QRadar Network Insights 1940 (Type 6600)
Stacking uses 1 of the 2 available ports on the NIC card, so even when stacked, the maximum throughput cannot exceed 40 Gbps.

For more information, see QRadar Network Insights appliance stacking.