[Oisf-users] Recommended Hardware Requirements

[Michał Purzyński]

You want to go with X710 (fun fact - it's actually cheaper than the old
X520) with Intel SPFs.

For the 10Gbit/sec you might want to consider dual-CPU setup. Just make
sure you maximize the memory bandwidth (and amount) by having one (and
ideally only one) DIMM in each CPU's memory channel.

The original performance tuning guide that also shows the recommended
architecture (we wrote it a couple years ago) is here
https://github.com/pevma/SEPTun



On Sun, Jun 30, 2019 at 12:40 PM Andreas Herz <aherz at oisf.net> wrote:

> Hi Req,
>
> On 27/06/19 at 22:24, Req Deny wrote:
> > All,
> >
> > I have been searching around and trying to lock down information on
> > recommended hardware requirements.  I looked through most of the
> > documentation, and sorry if I had missed it.
> >
> > Looking @ 1Gbps (Single Port Ingest)
> > Also @ 10Gbps (Single Port Ingest)
> >
> > Looking for cores/threads/ ram primarily.   Anything else I should be
> aware
> > of?
>
> You might want to take a look at the NIC as well. X520 or X710 might be
> a good choice for the 10GE setup.
>
> CPU should be a good mix between singlecore performance and amount of
> cores. Dual Socket setups are recommended and try to go for a Xeon with
> 8-10 cores each.
>
> RAM, as much as you can get, depending on the ruleset 128GB might be a
> good choice.
>
> --
> Andreas Herz
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
> Conference: https://suricon.net
> Trainings: https://suricata-ids.org/training/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190630/5c54bab2/attachment.html>