Flows on Purview

What is different between flow and session? Most of firewall keep the session information for the traffic. Can we use that information to calculate the requirement of the flow/mins license for Preview Engine?


1 reply

Flow are accounted unirectionally in periods of 60s. The session in your firewall is probably bidirectional so your flows/s should be roughly double your firewall sessions. One point, thought, that is the value at the point where the firewall is located. If you take traffic from other points in the network to purview, the results are completely unrelated.