If your choice is between more cores at a lower clock frequency, or fewer cores at a higher clock frequency, we recommend you go with the latter. A higher clock frequency helps individual threads run faster, while having additional cores allows more threads to run concurrently. FlowTraq Server does benefit from having additional cores because it is heavily multi-threaded; however, we have found that a higher clock speed gives a quicker response to client requests.

A general rule of thumb is that 4 cores are more than enough for most installations. In certain cases we would recommend more than 4 cores. For example, if you plan to run many input ports, or if you plan to serve a large number of concurrently-connected clients, then might suggest 6, or more, cores.

The more RAM, the better. More RAM means a longer history in the cache, which means fewer disk accesses. Disk is very slow compared to RAM, so the more data FlowTraq Server can keep in RAM, the quicker the queries return, and the faster your interactive traffic analysis will be.

The answer to this question depends on your flow rate and on how many months or years of historical forensic data you need to keep.

Flow data is very compact compared to packet captures. A rule of thumb we have observed is that a typical end user generates 100MB of stored flow records per year. So if there are 1000 end users in your network environment, and you need to be able to retain forensic records for 10 years, make sure you have at least 100MB/user/year*1000 users*10 years = 1,000,000M or 1TB of disk space.

You can dedicate up to 16TB of disk space to the database.

The higher the RPMs, the better. Speed limitations in modern hard disks are caused by the time it takes for the disk to rotate and the desired data to appear under the heads. The faster the disk spins, the quicker data can be written and read back. If you can get 15K RPM or better, get it!

A Redundant Array of Independent Disks is a beautiful thing when constructed correctly. But in many cases, RAID is slower than a single-disk setup. For instance, RAID levels 4, 5, and 6 offer great redundancy for a relatively small capacity overhead; however, each write will translate into as many as 4 physical disk accesses. Unless the disks are very fast, this may hurt more than it helps. RAID levels 0 (striping) and 1 (mirroring) generally offer faster read times at either a high capacity overhead (mirroring), or lack of redundancy (striping). We consider RAID 1+0 (striping and mirroring) ideal for speed, but it is expensive due to the capacity overhead.