Full dev is intended for testing, not actual use. That said, to answer your question it is more important to know (1) will you be storing pcap, (1b) if so, how much per day and for how long, (2) what data will you be sending into Metron (bro, yaf, snort, asa, etc.) and how many events per second is it, and (3) what are you planning to do with the data (profiling, MaaS, enrichments, etc.)?
Jon On Wed, Sep 20, 2017, 04:04 Syed Hammad Tahir <[email protected]> wrote: > Hello, > > What would be the system required in order to run metron and analyzy a LAN > environment of almost 100 nodes using single node full development > depoloyment. > > Regards. > -- Jon
