The packet store is first-in, first-out. Once the store is filled, the oldest packets will be removed to make room for the newest ones.
It's the size of the packetstore (maximum 4TB, once we address the issue I previously mentioned) divided by the average bitrate the packets are arriving. If you feed an appliance with 4TB of disk at 200 Mbps, you'll get a little less than 2 days. (Divide TB/Mbps) If the packets arrive twice as fast, @400 Mbps, you'll get half as much lookback, a little less than a day.
Does that answer your question?
The ETA 1150v is rated for 1Gbps, meaning that we expect to capture and store them all if inbound packets arrive at that rate or more slowly.
There are a couple of factors to be aware of in virtual environments. Packets may arrive at our VM at a rate greater than 1Gbps. In that case, we may not be able to capture them all, however that would be understandable as the workload is exceeding the appliance's specifications. Also, our being able to collect packets at a rate of 1Gbps depends on our being able to write to your packet virtual disk @ 1Gbps (125 MByte/sec). If storage is over-loaded in a virtualization environment such that 125 MByte/sec of disk bandwidth isn't available, the virtual appliance is left with no choice than to drop packets.