Insight network sensor seployment

InsightIDR
1

I am working on a deployment for a customer.

There is a core switch and a firewall. The network traffic from the branch offices bypasses the core switch. There are also several ESXi hosts.

I am thinking that the backplane traffic on the switch will warrant a 10 GiB connection and thus a HW sensor is justfied. With the firewall, I am also thinking that bursts may exceed 1 Gb/s and thus a HW box. There is no distributed switch, so one sensor per ESXi.

Am I right?

Thanks!

2

A virtual sensor will support speeds above 1Gbs if you wanted to stick to a VM model.

Sensor per ESX host will work but it takes time to set each up. If you can use a switch as a traffic source, it will cut down on the number of sensors you need

3

How much more? Most I can see on the Intarwebs is 1.5 GiB