Network Capacity Planning Azure ATP Sensor to Azure

[Bryan Bishop]

Hello,

Can you tell me if the capacity information "we send only 1-3% of the total traffic to the service for processing." is current?  

If so, would I use the network performance data captured in the capacity planning tool?
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-capacity-planning

Would I use 1-3% of Max Packet /secs column?

Thank you

[#2]

@Bryan Bishop That would be a very very rough estimation, as the actual values heavily depends on the  DC's traffic mix.

Honestly the only way to really test it is post deployment.
What I can tell you is that I never heard about a customer where the actual upload rate became an issue...

[#3]

@Eli Ofek   Thanks for the response. 

We have several hundred domain controllers and we need to make sure we forecast the impact to our WAN and outbound internet connections.  

Is there a better way to estimate outbound traffic capacity?   

Bryan

[#4]

@Bryan Bishop The best way will be to install the sensor on some of the busiest DCs and measure post deployment the impact on outgoing traffic from those machines to the internet. assuming your network traffic mix is similar across the sites, you will get more accurate numbers...

Again, the impact should be relatively small, so most customers don't even bother to check it. 

[#5]

@Eli Ofek 
Good morning,

Another question around capacity.  We currently have ATA implemented in a few of the domains that will be migrated to ATP.   Is there any data we can use in ATA to forecast the capacity for ATP?

[#6]

@Bryan Bishop I don't think so... they work very differently, because AATP is cloud based, it needs to transmit more data to the cloud compared to ATA which saves a lot of data locally.

Also, AATP has lot more data sources, so this is also a factor. at best, measuring the traffic fro teh gateways to the Center will give you maybe a min capacity, but I never tried that.