Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=NDR-VM-hardware-size-guide

Sophos NDR appliance size guide (hardware)

Log collector Sophos Network Detection and Response

Choose the hardware on which you'll configure Sophos NDR.

For hardware specifications, download the following file: Certified hardware specifications for NDR.

If you know the peak and sustained bandwidth consumption at the switch, you can map the maximum bandwidth information in the sizing document (Certified hardware specifications for NDR V1.1) to the peak bandwidth you experience. You'll need to check the capacity of the switch from which you'll get mirrored traffic. The NDR Sensor should have the same capacity. NDR is optimized to handle types of traffic, such as streaming and elephant flows (backup activity). Most threats are identified in typical browsing and general application network activity.

For a typical organization, we assume the following:

  • 20 per cent of users are power users with multiple devices (for example, developers), 60 per cent are typical users with browsing and email activity, and 20 per cent are light users.
  • The organization uses VoIP, has some video streaming, large file upload and download activity, and servers for applications and web hosting.

The hardware recommendations are as follows:

  • NUC or OnLogic (2.5GBPS): Supports up to 2.5K users, around 0.7 Gbps of traffic, and a peak load of two to three times more.
  • OnLogic MC510-55 (2.5GBPS): Supports up to 2.5K users, around 0.7 Gbps of traffic, and a peak load of two to three times more.
  • DELL R350 (4GBPS): Supports up to 5K users, around 1.4 Gbps of traffic, and a peak load of two to three times more.
  • DELL R360 (4GBPS): Supports up to 5K users, around 1.4 Gbps of traffic, and a peak load of two to three times more.
  • DELL R450 (10GBPS): Supports up to 12.5K Users, around 3.4 Gbps of traffic, and a peak load of two to three times more.
  • DELL R650 (20GBPS): Supports up to 25K Users, around 6.8 Gbps of traffic, and a peak load of two to three times more.
  • DELL R660xs (20GBPS): Supports up to 25K Users, around 6.8 Gbps of traffic, and a peak load of two to three times more.
  • DELL R660 (40GBPS): Supports up to 50K Users, around 13.7 Gbps of traffic, and a peak of two to three times more.

Note

If your users also stream videos and music, you may need the next size up. If they mostly email, you can use a smaller size.