Skip to content

Hardware requirements

Quick sizing table

Component Minimum Recommended Notes
Web UI 16 GB RAM 32 GB+ RAM VM supported; fast SSD/NVMe storage; keep free storage for DB operations
Network Agent 8 GB RAM 8 GB+ RAM VM possible, bare metal preferred; dedicated capture NIC; 2.5 Gbps (office) or 10 Gbps (higher throughput)
Honeypot No special requirement VM or low-power host 2 IPs recommended (management + service exposure)
Egress Agent No special requirement VM or low-power host Similar to Honeypot, but second IP is not required

Web UI

  • Can run as a virtual machine.
  • RAM: 16 GB absolute minimum, 32 GB+ recommended.
  • Storage: fast storage is required (SSD/NVMe recommended).
  • Keep additional free storage for database operations (indexes, temporary operations, growth).
  • As a rough reference, a normal office network of ~100 devices can consume around 10 GB of database space for metadata per month.

Network Agent

  • Can run as a virtual machine, but bare metal is recommended for reliability and packet capture quality.
  • RAM: 8 GB recommended.
  • No special high-end CPU or storage is required.
  • Requires a second reliable network adapter dedicated for traffic capture (SPAN/mirror input).
  • Requires switch port mirroring (SPAN) configuration to send target traffic to the capture NIC.

  • Capture NIC speed should match expected traffic volume:

    • 2.5 Gbps is typically enough for normal office traffic.
    • 10 Gbps is recommended for higher-throughput environments.

Honeypot

  • No special hardware requirements.
  • Can run as a virtual machine.

  • Recommended to use 2 IP addresses:

    • one for honeypot management
    • one for exposed honeypot services

Egress Agent

  • No special hardware requirements.
  • Can run as a virtual machine.
  • Similar to Honeypot sizing, but a second IP is not required.