Skip to content
Find out how we support MDR.

Sophos NDR VM size guide

The Sophos NDR virtual appliance is a traffic analyzer that runs on a VM on an ESXI server.

You might need to configure the VM to ensure that the NDR virtual appliance gives the best performance and least impact on the network.

Here are our recommendations, based on your network traffic.

  • Medium traffic


    • up to 500Mbps
    • up to 70,000 packets per second
    • up to 1200 flows per second

    You can install the virtual machine using the defaults. No changes to VM settings are required.

  • Large traffic


    • up to 1Gbps
    • up to 300,000 packets per second
    • up to 4500 flows per second

    You should resize your VM to 8 vCPUs.

VM running multiple integrations

The recommendations above are for a VM running Sophos NDR only. If it's also running one or more log collector integrations under heavy load, you might need to add more virtual CPUs.

Each log collector integration uses approximately 400MB RAM under heavy load. So you might need to add more RAM to the VM.

VM in a larger network

If your network statistics are higher than those in the Large traffic configuration, deploy multiple virtual appliances throughout your network.