Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=NDR-VM-size-guide

Sophos NDR appliance size guide

The Sophos NDR virtual appliance is a traffic analyzer that runs on a VM.

You might need to configure the VM to ensure that the NDR virtual appliance gives the best performance and least impact on the network.

Here are our recommendations, based on your network traffic.

  • Medium traffic

    • up to 500Mbps
    • up to 70,000 packets per second
    • up to 1200 flows per second

    You can install the virtual machine using the defaults. No changes to VM settings are required.

  • High traffic

    • up to 1Gbps
    • up to 300,000 packets per second
    • up to 4500 flows per second

    You should resize your VM to 8 vCPUs.

VM running multiple integrations

The recommendations above are for a VM running Sophos NDR only. If it's also running one or more log collector integrations under heavy load, you might need to add more virtual CPUs.

Each log collector integration uses approximately 400MB RAM under heavy load. So you might need to add more RAM to the VM.

VM in a larger network

If your network statistics are higher than those in the High traffic configuration, deploy multiple virtual appliances throughout your network.