These calculations also apply when the application is deployed on a virtual platform.
When calculating the hardware requirements for the Sensor component, consider that the maximum traffic volume that can be processed is 10 Gbps. This maximum traffic volume can be processed on one Sensor installed on a standalone server or on multiple Sensors installed on standalone servers which are connected to one Central Node. The total traffic volume from all Sensors connected to one Central Node may not exceed 10 Gbps.
If the network includes more than one 10 Gbps segment and you need to process traffic in these segments, you must use the distributed solution mode.
You can use a server hosting the Sensor as a proxy server during data exchange between workstations with Endpoint Agent and the Central Node to simplify configuration of network rules. For example, if workstations with Endpoint Agent are in a separate segment of the network, it is sufficient to configure a connection between Central Node and Sensor servers.
When using the Sensor as a proxy server for communication between Endpoint Agent components and the Central Node component, consider the following limitations:
The required bandwidth of the link between Central Node and Sensor servers depends on the traffic volume that must be processed and is calculated as follows:
10% SPAN port traffic at typical load or 20% of the SPAN port traffic at peak load + email traffic + ICAP traffic + requirement for the link between the Central Node and the Endpoint Agent
Hardware requirements for the Sensor server
The Sensor component can be integrated with the IT infrastructure of an organization as follows:
The hardware requirements for the Sensor server are listed in the table below. The calculations are provided for a case in which the Sensor processes email messages and mirrored traffic from SPAN ports. If the Sensor is used as a proxy server for communication between Endpoint Agent workstations and the Central Node, you must also take into account the link requirements.
Hardware requirements for the Sensor server depending on the volume of processed traffic from SPAN ports
Number of Endpoint Agent components |
Volume of processed traffic (Mbps) |
Minimum RAM (GB) |
Minimum number of logical cores |
---|---|---|---|
10000 |
100 |
16 |
4 |
15000 |
500 |
24 |
8 |
15000 |
1000 |
32 |
12 |
15000 |
2000 |
64 |
20 |
15000 |
4000 |
92 |
32 |
15000 |
7000 |
128 |
52 |
15000 |
10000 |
160 |
72 |
The CPU must support the BMI2, AVX, and AVX2 instruction sets.
If you want to process only email messages, but not mirrored traffic from SPAN ports, we recommend using a Sensor installed on the same server as the Central Node. For more details about the hardware requirements, see the Calculations for the Central Node component section → Hardware requirements for the Central Node and Sensor server.
If one Sensor server processes traffic via multiple protocols, to calculate the server hardware, you must consider that mail server or mail sensor integration requires disabling SMTP traffic processing.
Disk space requirements on a Sensor server
It is recommended to use a RAID 1 disk array. The total disk space must be at least 500 GB.
Hardware requirements of the Sensor when saving raw network traffic
If you are saving raw network traffic, the hardware requirements of the Sensor server are higher:
<disk storage bandwidth> = 3 * <maximum throughput of recorded traffic>