Network Sensor Host System Requirements

This article covers all host system requirements for the Rapid7 Network Sensor (Insight Network Sensor). You can install a network sensor on either a physical or virtual host.

Operating System

Although the network sensor software itself runs in the form of a container, all physical or virtual network sensor hosts must run one of the following supported Linux operating systems. The version number shown for each indicates the minimum supported version:

• Ubuntu Server 20.04 and above
• RHEL 7.2 and above
• CentOS Stream 9
• Rocky Linux 9
• Fedora 30 and above
• SUSE 15.0 and above
• Debian 8.11 and above

Sensor Host Recommended Specs

If you deploy the network sensor on a physical host, ensure that your machine meets the following specifications:

Deployments up to 1 Gbps

• Processor - Minimum of 4 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - Minimum of 16 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 1 Gbps RSS-capable PCI interface
• Storage - 100 GB of available disk space recommended

Deployments up to 10 Gbps

• Processor - Minimum of 8 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - Minimum of 32 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 10 Gbps RSS-capable PCI interface
• Storage - 100 GB of available disk space recommended

Deployments up to 25 Gbps

• Processor: Minimum of 12 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 32 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 25 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

Deployments up to 40 Gbps

• Processor: Minimum of 18 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 64 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 40 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

Deployments up to 100 Gbps

• Processor: Minimum of 42 cores
  • Intel Xeon Gold or Platinum strongly recommended
• Memory: Minimum of 128 GB of RAM
• Management interface: 1 Gbps interface or higher
• Traffic capture interface: 100 Gbps RSS-capable PCI interface
• Storage: 100 GB of available disk space recommended

For optimal performance, choose a NIC with a driver that fully supports Receive Side Scaling (RSS), including symmetric hash key configuration by using ethtool. In practice, Intel NICs are recommended for most deployments. Broadcom NICs have inconsistent RSS support depending on kernel version and may fall back to single-thread mode; avoid them for new deployments if possible.

As a general guide, match your capture NIC to your expected traffic volume:

The sensor will automatically detect RSS capabilities at startup and scale across available NIC queues and CPU cores accordingly.

Virtual Deployment Infrastructure

If you virtualize the network sensor host, you must do so with a VMware ESXi hypervisor.

There are two options for Enhanced vMotion Compatibility (EVC) virtualizations:

• Enhanced vMotion Compatibility (EVC) entirely disabled (recommended)
• Enhanced vMotion Compatibility (EVC) compatibility mode “Sandy Bridge” (minimum)

If you deploy the network sensor as a virtual machine, ensure that your machine meets the following specifications:

• Processor - Minimum of 4 cores:
  • Intel Sandy Bridge microarchitecture (Core i3/i5/i7, Xeon E3/E5) or later
  • AMD Zen microarchitecture Ryzen 2017 or later
• Memory - Minimum of 16GB of RAM
• Storage - 100GB of available disk space recommended
• Set disk to ParaVirtual. See https://kb.vmware.com/s/article/1010398  for more information.
• Change Latency Sensitivity to “High”. The “Latency Sensitivity” is an “Advanced” option which can be found under the “VM Options” section of a virtual machines settings page. See https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.resmgmt.doc/GUID-9F4FD589-A73B-454A-A5A5-FED4C0F918C3.html  for more information.
• Scheduling Affinity - Map virtual CPUs to physical so that they are reserved. See https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-3D5F6146-5F9C-46BC-B1D3-DCA856E98137.html  for more information.
• Set CPU Reservation to maximum allowed. See https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-3D5F6146-5F9C-46BC-B1D3-DCA856E98137.html  for more information.
• Reserve guest memory. This can be found under the memory section of the sensor virtual machine settings.

If you want to connect your virtual sensor to a physical SPAN or mirror port via a dedicated NIC then you should also use PCI Passthrough. See https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-386F225C-C890-4437-874B-449796423D4A.html  for more information.

Network Interface Controllers (NICs)

All physical or virtual network sensor hosts require two Network Interface Controllers (NICs):

• One NIC for the network sensor to receive network traffic from your configured source.
  • This NIC should be configured without an IP address since its only purpose is to ingest network traffic.
  • Choose a NIC with sufficient bandwidth for your expected traffic volume. At 10 Gbps and above, RSS support is effectively required — refer to the NIC recommendations above to ensure your chosen NIC is supported.
• One NIC for the network sensor to transmit processed traffic to the Insight platform for your Insight products to analyze.
  • Since the network sensor software also comes pre-packaged with the Rapid7 Agent (Insight Agent), this communication NIC must have an IP address so that the Insight platform can identify it as it would with any other asset.