🪝Deploy n.Probes, n.Rewind, n.Fusion

After installing n.Scope server, the installation package for Probes, Rewind, and a combination of both (Fusion) are generated with the required credentials and certificates. This step will guide you through preparing the servers for deployment and installation of the package.

1. Server Pre-requisites

1.1 Sizing for n.Probes servers

n.Probes node only perform observability of network packets, extracting their metadata. They are the corner stone of n.Scope Platform Observability and Detection.

Bandwidth	CPU Cores	RAM	System Disk	Network Card
1 Gbps	4	4 GB	50 GB	Any Recent
2.5 Gbps	6	4 GB	50 GB	Any Recent
10 Gbps	8	8 GB	50 GB	Intel X710
25 Gbps	12	16 GB	50 GB	Intel XXV710
50 Gbps	20	32 GB	50 GB	Intel XXV710
100 Gbps	32	48 GB	50 GB	Intel e810

1.2 Sizing for n.Rewind servers

Rewind comes with a Packet Buffer that will hold for a period of time packets to allow for their delayed captures. This buffer is done in RAM, thus the augmented requirements for system RAM.

Bandwidth	CPU Cores	RAM	System Disk	PCAP Disk	Network Card
1 Gbps	4	16 GB	50 GB	512 GB	Any Recent
2.5 Gbps	4	32 GB	50 GB	768 GB	Any Recent
10 Gbps	6	96 GB	50 GB	1 TB	Intel X710
25 Gbps	12	256 GB	50 GB	2 TB	Intel XXV710
50 Gbps	20	512 GB	50 GB	4 TB	Intel XXV710
100 Gbps	40	1 024 GB	50 GB	8 TB	Intel e810

RAM sizing is given for a 60 secondes Past-Packet Buffer for a given bandwidth. To adjust the cost of the underlying server, the buffer time can be reduced. We can help you tailor this setting, drop us an email at [email protected].

1.3 Sizing for n.Fusion servers

Fusion are a combination of Probes and Rewind on the same platform. It comes with a Packet Buffer that will hold for a period of time packets to allow for their delayed captures. This buffer is done in RAM, thus the augmented requirements for system RAM.

Bandwidth	CPU Cores	RAM	System Disk	PCAP Disk	Network Card
1 Gbps	8	24 GB	50 GB	512 GB	Any Recent
2.5 Gbps	8	32 GB	50 GB	512 GB	Any Recent
10 Gbps	12	96 GB	50 GB	1 TB	Intel X710
25 Gbps	12	256 GB	50 GB	2 TB	Intel XXV710
50 Gbps	20	512 GB	50 GB	4 TB	Intel XXV710
100 Gbps	40	1 024 GB	50 GB	8 TB	Intel e810

RAM sizing is given for a 60 secondes Past-Packet Buffer for a given bandwidth. To adjust the cost of the underlying server, the buffer time can be reduced. We can help you tailor this setting, drop us an email at [email protected].

Fusion Servers requires three Network interfaces: - One for Management - One for Probe Observation - One for Rewind Packet Capture

1.4 OS Requirements

Nano Corp officially supports n.Scope installation on Oracle Linux version 8.8. You can retrieve your preferred installation medium here

We are considering supporting more operating systems. Drop us an email at [email protected] to let us know which one you would prefer.

2 n.Probe, n.Rewind, and n.Fusion install pre-requisites

Before starting to install the software package, a few actions must be taken on the server:

2.1 Configure BIOS/UEFI

In BIOS/UEFI, the following options must be enabled:

• IOMMU,

• Intel Vitualization Technologyor or AMD-V / AMD Virtualization,

• VTd / VT-x,

• SVM (AMD) or VMX (Intel),

• Memory remapping

  • HP Servers doc

2.2 Update distribution to the last version of Oracle Linux

#Upgrade to last version
dnf update -y

In case your base install isn’t OL v8, reach out to us on Slack and we’ll help you out to install the software

2.3 Install the required packages

dnf install -y coreutils gawk curl grep tar openssl pciutils driverctl grubby bash-completion nano

Some packages could be already installed through OL8 distrib minimal install.

2.4 Reboot the server

#reboot to switch on last kernel / versions
reboot

3 Installing Software Package

3.1 Copy the n.Probe directory from n.Scope to each probes

Installation of n.Probes comes from n.Scope servers. We recommend using the scp command to upload the packages to each probe you would like to install.

#From n.Scope server install directory
scp -r n.Probe root@{PROBE IP ADDRESS}:/root/

3.2 Launch install script on each n.Probe server

Installation must be performed as root. Log in to the console as root using the `sudo su` command.

Connect to each server you sent the installation package to and run the following commands:

#On each n.Probe server
sudo su
cd /root
./n.Probe/install_nProbe_nRewind_2NICs.sh

You will have to confirm software installation by stroking the y key. Through the course of the installation, you will have to confirm NIC cards to use for trafic monitoring.

3.3 Check installation success

After the installation script, n.Probe and n.Rewind software will be running on the probe. You can check they are running using the following commands:

• Check that n.Probe is running:

ps-ef | grep probe

• Check that n.Scope is running:

ps-ef | grep rewind

All done ! Connect to the n.Scope instance and see data coming in.

You might want to check out how to use n.Scope in those two sections:

📎Explore your Network🚨Using Alerts