Sophos NDR on hardware

You can install Sophos NDR on hardware.

This page lists requirements and recommendations for hardware where you want to install and run Sophos NDR.

Requirements

The hardware must support UEFI BIOS boot mode and GPT partitions.

CPUs

CPUs must meet these requirements:

• Clock speed 2.5 GHz or higher

• Support CPU flags pdpe1gb and avx2

  • For Intel CPUs, these flags are fully supported starting with Skylake, which was released in Q3 2015.
  • For AMD CPUs, these flags are fully supported starting with Zen, which was released in Q2 2017.

Memory

Minimum memory specification is DDR4-2400.

Storage

The recommended storage medium is a high-performance NVMe drive. The second-best choice is a high-performance SAS drive.

We encourage you to use RAID if you require redundancy. However, whether you use RAID or not, we only support single-drive or dual-drive configurations.

Network cards

Hardware should have at least two network interfaces, one for management and syslog, and the other for packet capture.

Network interfaces that are used for management and log collection can be any interface supported by Oracle Linux 9.

NDR uses the Data Plane Development Kit (DPDK) for packet capture, so it's limited to specific network cards that support DPDK. Below are details of vendors and chipsets that are supported for packet capture.

Intel

These chipsets are best supported:

• igb
• i40e
• ice

Other supported Intel chipsets are as follows:

• 82571
• 82572
• 82573
• 82574
• 82583
• ICH8
• ICH9
• ICH10
• PCH
• PCH2
• I217
• I218
• I219
• E610

Broadcom

These chipsets are supported:

• NetXtreme C,E, and S chipsets

Mimimum recommendations

Below are minimum recommendations for CPUs, memory, storage, and network card, for each appliance size.

Up to 1 Gbps or 4k connections per second (desktop or server)

We recommend:

• Intel Core i5 with at least 4 cores and 8 threads
• 16 GB of memory
• 1 TB of high performance NVMe or SAS storage
• Intel i350 1 GbE network card (dual or quad port)

Up to 4 Gbps or 8k connections per second (server)

We recommend:

• Intel Xeon with at least 8 cores and 16 threads
• 32 GB of memory
• 2 TB of high performance NVMe or SAS storage
• Two onboard NICs for management and syslog, and a support NIC card capable of ingesting 4 Gbps

Up to 10 Gbps or 20k connections per second (server)

We recommend:

• Intel Xeon with at least 16 cores and 32 threads
• 64 GB of memory
• 3 TB of high performance NVMe or SAS storage

• Two onboard NICs for management and syslog, and a support NIC card capable of ingesting 10 Gbps:

  • Intel X710-T2L Dual Port 10 GbE Base-T
  • Intel E810-XXV Dual Port 10 or 25 GbE SFP28
  • Broadcom BCM57416 NetXtreme-E Dual-Media 10GBASE-T
  • Broadcom BCM57810S Controller Dual 10 G SFP

Up to 20 Gbps or 40k connections per second (server)

We recommend:

• Intel Xeon with at least 24 cores and 48 threads
• 64 GB of memory
• 4 TB of high performance NVMe or SAS storage

• Two onboard NICs for management and syslog, and a support NIC card capable of ingesting 20 Gbps:

  • Intel X710-T2L Dual Port 10 GbE BASE-T
  • Intel E810-XXV Dual Port 10 GbE or 25 GbE SFP28
  • Broadcom BCM57810S Controller Dual 10 G SFP

Up to 40 Gbps or 80k connections per second (server)

We recommend:

• Intel Xeon with at least 32 cores and 64 threads
• 64 GB of memory
• 6 TB of high performance NVMe or SAS storage

• Two onboard NICs for management and syslog, and a support NIC card capable of ingesting 40 Gbps:

  • Intel X710-T2L Quad Port 10 GbE BASE-T
  • Intel E810-XXVDA4 Quad Port 10 GbE or 25 GbE SFP28

Up to 40 Gbps or 100k connections per second (server)

We recommend:

• 2 Intel Xeon with at least 32 cores and 64 threads
• 128 GB of memory
• 6 TB of high performance NVMe or SAS storage

• Two onboard NICs for management and syslog, and a support NIC card capable of ingesting 40 Gbps:

  • Intel X710-T2L Quad Port 10 GbE BASE-T
  • Intel E810-XXVDA4 Quad Port 10 GbE or 25 GbE SFP28