By default, each AutoDiscovery server installation comes pre-installed with a single sensor, used to capture data from across your network.
You may need additional sensors if you want to use direct traffic collection, full traffic capture, or if you want to separate your AutoDiscovery server and sensor machines. For more details, see Traffic collection options.
This topic describes how to install additional sensors as needed, either directly on a Windows or Linux machine, or as a VMWare OVF.
In this topic:
Sensor installation options
The following table describes the supported configurations for installing additional sensors, and the high-level steps required for each configuration:
ESX with port mirroring
Do the following:
Deploy an AutoDiscovery sensor to each ESX server.
Configure each sensor to view traffic in promiscuous mode.
Physical server with port mirroring
Do the following:
Prepare a separate server for the AutoDiscovery sensor. The server can be physical or virtual, and Windows or Linux.
Direct mirrored traffic to the sensor.
Local mode with direct capture
Install a sensor on any server from which you want to capture traffic.
Note: If you are installing additional sensors, you must do so using different machines than the ones you are using for the AutoDiscovery server and the ASMS installation. Each additional sensor must be installed on its own machine.
On the AlgoSec portal, navigate to Downloads > Software > AlgoSecAutoDiscovery.
This section describes system requirements for AutoDiscovery sensors installed in addition to the one provided by the AutoDiscovery installation. Additional sensors are most often configured for full traffic capture.
Note: The number of sensors to install and where to install them depends on your network's load and topology.
For example, if you have packet brokers or standalone sniffers already collecting traffic on your network, you can send the traffic they collect to a single sensor. This avoids the need to thoroughly cover your network with sensors.
Configure full capture by connecting an AutoDiscovery sensor to a mirrored switch port or a TAP device.
In both cases, the output rate must match the AlgoSec appliance collector rate and interface.
System requirements for full capture include the following:
Collection rates
Supported collection rates are 250,000 packets(s) for an AlgoSec 2062 appliance-based collector and 1,000,000 packet(s) for an AlgoSec 2322 appliance.
These are recommended collection rates, since AlgoSec AutoDiscovery is statistical in nature and a loss of a few packets has no adverse effect.
ESX infrastructure
In order to enable port mirroring for a Sensor is installed on an ESX server, the server must be configured in promiscuous mode and the traffic must be mirrored to a port group.
Adding a Sensor to that port group will enable the Sensor to capture all of the traffic.
Log formats
From version 2.4.3, the Sensor can optionally receive traffic in the following log formats:
ERSPAN (type 2 and 3)
GRE (IP 800 and Transparent Ethernet Bridging 6558)
Encapsulated Remote Mirroring in VMware environments (on VDS from VSphere 3.5.1 and up)
Port mirroring hardware requirements
When installed in port mirroring mode, memory and CPU requirements depend on the amount of traffic monitored.
Estimated minimum requirements include:
Dual CPU/dual core
2GB RAM
10MB free disk space
2 Network Adapters - one connected to the mirror port, the other connected to the LAN.
Note: For information on how to configure mirroring for a port, see your Switch/Router/Firewall documentation.
Yes 
No 
