Network Sensor Host System Requirements

This article covers all host system requirements for the Rapid7 Network Sensor (Insight Network Sensor). You can install a network sensor on either a physical or virtual host.

Operating System

Although the network sensor software itself runs in the form of a container, all physical or virtual network sensor hosts must run one of the following supported Linux operating systems. The version number shown for each indicates the minimum supported version:

• Ubuntu Server 20.04 and above
• RHEL 7.2 and above
• CentOS Stream 9
• Rocky Linux 9
• Fedora 30 and above
• SUSE 15.0 and above
• Debian 8.11 and above

Sensor Host Recommended Specs

If you deploy the network sensor on a physical host, ensure that your machine meets the following specifications:

Deployments up to 1 Gbps

• Processor - Minimum of 4 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - Minimum of 16 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 1 Gbps RSS-capable PCI interface
• Storage - 100 GB of available disk space recommended

Deployments up to 10 Gbps

• Processor - Minimum of 8 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - Minimum of 32 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 10 Gbps RSS-capable PCI interface
• Storage - 100 GB of available disk space recommended

Deployments up to 25 Gbps

• Processor: Minimum of 12 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 32 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 25 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

Deployments up to 40 Gbps

• Processor: Minimum of 18 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 64 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 40 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

Deployments up to 100 Gbps

• Processor: Minimum of 42 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 128 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 100 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

For optimal performance, choose a NIC with a driver that fully supports Receive Side Scaling (RSS), including symmetric hash key configuration by using ethtool. In practice, Intel NICs are recommended for most deployments. Broadcom NICs have inconsistent RSS support depending on kernel version and may fall back to single-thread mode; avoid them for new deployments if possible.

As a general guide, match your capture NIC to your expected traffic volume:

The sensor will automatically detect RSS capabilities at startup and scale across available NIC queues and CPU cores accordingly.

Virtual Deployment Infrastructure

If you virtualize the network sensor host, you can do so with any of the following hypervisors:

• VMware ESXi
• Microsoft Hyper-V on Windows Server 2022 or 2025
• Nutanix AHV

Other hypervisors may be viable for sensor installation but are not officially supported.

Virtual Machine Specifications

Whichever hypervisor you use, ensure that your virtual machine meets the following specifications:

• Processor - Minimum of 4 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - 16GB of RAM recommended. If host resources are limited and you expect low traffic volume, you can allocate less.
• Storage - 100GB of available disk space recommended
• Reserve guest memory. This can be found under the memory section of the sensor virtual machine settings.

The throughput specifications above also apply to virtual hosts. Size your virtual machine according to the traffic volume you expect it to process.

VMware ESXi

For ESXi deployments, there are two supported options for Enhanced vMotion Compatibility (EVC):

• Enhanced vMotion Compatibility (EVC) entirely disabled (recommended)
• Enhanced vMotion Compatibility (EVC) compatibility mode “Sandy Bridge” (minimum)

Configure the following on your ESXi virtual machine in addition to the specifications above:

• Set disk to ParaVirtual. For more information, refer to https://kb.vmware.com/s/article/1010398 .
• Change Latency Sensitivity to “High”. The “Latency Sensitivity” is an “Advanced” option which can be found under the “VM Options” section of a virtual machines settings page. For more information, refer to https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.resmgmt.doc/GUID-9F4FD589-A73B-454A-A5A5-FED4C0F918C3.html .
• Scheduling Affinity - Map virtual CPUs to physical so that they are reserved. For more information, refer to https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-3D5F6146-5F9C-46BC-B1D3-DCA856E98137.html .
• Set CPU Reservation to maximum allowed. For more information, refer to https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-3D5F6146-5F9C-46BC-B1D3-DCA856E98137.html .

If you want to connect your virtual sensor to a physical SPAN or mirror port via a dedicated NIC then you should also use PCI Passthrough. For more information, refer to https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-386F225C-C890-4437-874B-449796423D4A.html .

To configure your traffic source on ESXi, refer to Virtual Network Traffic Sources.

Microsoft Hyper-V

Hyper-V deployments require two virtual switches: one for management and one to receive SPAN traffic. The monitoring switch needs the Microsoft NDIS Capture extension enabled and its monitoring mode set, and the monitoring network adapter on the virtual machine must have its port mirroring mode set to Destination.

These steps were tested on Windows Server 2022 and 2025, but should be applicable to other Windows Server versions or to a standalone Hyper-V server.

For the full procedure, refer to the Network Sensor for Hyper-V Deployment Guide.

Nutanix AHV

AHV deployments use the native Traffic Mirroring feature to copy traffic from a physical uplink or a VM’s vNIC to a dedicated capture vNIC on the sensor VM. The capture vNIC is created as a Traffic Mirroring destination vNIC, and the sensor VM generally must run on the same AHV host as the traffic source. If the cluster is registered to Prism Central, Traffic Mirroring must be configured through Prism Central instead of aCLI. This documentation does not cover the Prism Central procedure.

Monitoring traffic from an external SPAN or TAP source instead requires either an SR-IOV NIC Profile configured through Prism Central, or a dedicated virtual switch. The SR-IOV route has AOS, AHV, and Prism Central version requirements, and needs an SR-IOV-capable NIC.

For the full procedure, refer to the Network Sensor for Nutanix AHV Deployment Guide.

Network Interface Controllers (NICs)

All physical or virtual network sensor hosts require two Network Interface Controllers (NICs):

• One NIC for the network sensor to receive network traffic from your configured source.
  • This NIC should be configured without an IP address since its only purpose is to ingest network traffic.
  • Choose a NIC with sufficient bandwidth for your expected traffic volume. At 10 Gbps and above, RSS support is effectively required — refer to the NIC recommendations above to ensure your chosen NIC is supported.
• One NIC for the network sensor to transmit processed traffic to the Insight platform for your Insight products to analyze.
  • Since the network sensor software also comes pre-packaged with the Rapid7 Agent (Insight Agent), this communication NIC must have an IP address so that the Insight platform can identify it as it would with any other asset.