Sensor Installation Prerequisites

Physical and Virtual Machines

Sensor PrerequisitesYou can install a sensor on a physical appliance or virtual machine, with the following requirements:

[REQUIRED] At least one network interface (the "Control" interface) for passing information to the Stealthwatch Cloud service, and for collecting flow data, including NetFlow, IPFIX, or sFlow, depending on configuration

[OPTIONAL] one or more optional additional network interfaces ("Mirror" interfaces) if you want to ingest network traffic over a mirror port

[REQUIRED] 2 GB RAM

[REQUIRED] A CPU with at least two cores

[REQUIRED] 32 GB of storage space

[REQUIRED] Internet access, to download required packages for the installation process

See this white paper for performance metrics and recommendations.Physical Appliance Additional RequirementsTo upload the ISO install file to a physical appliance, you need either:

a USB port and USB flash drive, or

an optical disc drive and writeable optical disc

See 6. Boot Media Creation – Physical Appliances Only for more information.Virtual Machine Additional RequirementsIn addition to one network interface (the Control interface), 2 GB RAM, a CPU with at least two cores, 32 GB of storage space, and internet access, ensure that the virtual host and network are configured for promiscuous mode on the second network interface if you plan to ingest traffic from a mirror or SPAN port.VirtualBox - See this VirtualBox manual link for more information on configuring promiscuous mode.

Select the adapter for the Mirror interface from the Network settings.

Set promiscious mode to Allow in the Advanced Options.

VMware hypervisor - See this VMware knowledge base article for more information on configuring promiscuous mode. You may need to set the VLAN ID to 4095.

Select the host in the inventory.

Select the Configuration tab.

Click Networking.

Click Properties for your virtual switch.

Select the virtual switch and click Edit.

Select the Security tab.

Select Accept from the Promiscious Mode drop-down.