Installation Options
Bare metal
Deploy directly on dedicated physical servers for maximum performance and lowest latency.
Sensor: Multi-core Intel Xeon 6 Performance series, 128 GB–4 TB RAM, BOSS-N2 boot RAID 1 (OS separation), high-speed NICs, large ring buffers, and RSS.
Manager: Similar CPU/RAM but optimized for storage (RAID 10 NVMe).
Installation process: Official ISO → automated Ansible playbooks (
ndr-sensor-install,ndr-manager-install). They configure AF_PACKET threads, CPU affinity, hugepages, and systemd services. Post-install tune scripts validate 0% packet loss.
Virtualized deployment
Supported hypervisors: VMware ESXi 8.x (SR-IOV strongly recommended), KVM/libvirt, Microsoft Hyper-V, Nutanix AHV.
Sensor VM: Dedicated passthrough or SR-IOV NICs, pinned CPUs, NUMA alignment, 1 GB hugepages, and AF_PACKET in
cluster_flowmode.Manager VM: Standard vCPU/memory.
Performance is identical to bare metal when tuning is correct.
Turnkey appliances
Pre-built 1U/2U Dell PowerEdge servers include factory-optimized BIOS, firmware, drivers, and BOSS-N2 boot storage.
Available performance tiers: 100Mb, 1Gb, 10Gb, 20Gb, 40Gb, 100Gb (detailed in Section 5).
Factory image includes Suricata 8.0, Manager or Sensor software, and all performance tuning.
This is the simplest deployment path for customers who require guaranteed 0% packet loss.