What Hardware Do I Need to Run Andrisoft Wanguard or Wansight?

Updated

Any 64-bit Intel or AMD server can run Andrisoft's Wanguard and Wansight — there is no proprietary appliance. The software ships as Linux packages installed on commodity hardware, so you build the server yourself and size each component (Console, Flow Sensor, Packet Sensor, Filter) according to the traffic you need to monitor or mitigate. Andrisoft publishes a per-component sizing guide and a list of tested network cards for 10–100 Gbps. Virtual machines are recommended for trials only, not production.

The hardware model in one paragraph

Andrisoft does not sell an appliance that sits in your traffic path. Wanguard (DDoS detection and mitigation) and Wansight (traffic monitoring and accounting) are Linux packages you install on your own servers. That means the hardware decision is yours: you choose the CPU, RAM, storage and network cards, and you decide how many servers to deploy. The same packages run every role, and a license key determines which capabilities are switched on.

Sizing is per component, not per product

The stack is split into distinct roles, and each has its own resource profile. You size them separately rather than picking one "Wanguard server":

Component What it does What drives its sizing
Console Central management, reporting, configuration Number of Sensors and managed devices
Flow Sensor Analyzes NetFlow, sFlow, IPFIX Flow export volume from your routers
Packet Sensor Analyzes mirrored packets Mirrored throughput and packet rate
Filter Scrubs diverted attack traffic at line rate Attack traffic volume to be filtered

Because detection runs on flow or packet data and mitigation runs either on your routers (Flowspec, RTBH) or on Linux filtering servers, you can spread these roles across multiple machines. A small deployment might combine roles on one server; a large one separates the Filter from the Console and Sensors.

Andrisoft provides a dedicated sizing guide that walks through each component. Use it as the starting point rather than guessing from total bandwidth alone — flow export rate, packet rate and filtering throughput are different loads.

Network cards matter more than the CPU for high throughput

For 10–100 Gbps operation, the network card is the component most likely to become the bottleneck. Andrisoft maintains a list of tested network cards for that range, so check it before buying. A server that handles 10 Gbps of mirrored traffic may not handle 100 Gbps with the same NIC, even with a faster CPU.

The DPDK Engine is a separately licensed option relevant to high-performance packet processing; if you plan to push high packet rates through a Filter or Packet Sensor, factor that into both the hardware and license plan.

Virtual machines: trials only

Andrisoft states that virtual machines are for trials only. You can run the software in a VM to evaluate it, but production deployments should use physical servers. The reasons are practical: packet capture and line-rate filtering depend on direct access to network interfaces and consistent CPU scheduling, which virtualized environments do not reliably provide.

What to check before you buy hardware

  1. Confirm your server is 64-bit Intel or AMD — this is the only hard platform requirement stated.
  2. Decide which roles you will run (Console, Flow Sensor, Packet Sensor, Filter) and whether mitigation happens on your routers or on Linux filtering servers.
  3. Work through Andrisoft's per-component sizing guide for each role.
  4. Cross-check your intended NIC against the tested network card list for 10–100 Gbps.
  5. If you need high packet-rate processing, confirm whether the DPDK Engine license applies to your design.
  6. Start with a free 30-day trial key to validate sizing on real traffic before committing to production hardware.

Licensing context that affects hardware planning

Sensor licenses are $595 per year with volume discounts, and the Console is free. Because the Console carries no license cost, the main licensing variable is the number of Sensors and any Filter or DPDK Engine licenses. That matters for hardware planning: adding a Sensor means both another server (or another role on an existing server) and another annual license, so it is worth consolidating roles where your traffic volume allows.

Wansight uses the same Sensors and Console without detection and mitigation, and it becomes Wanguard when you apply a key — so hardware bought for monitoring can later support mitigation without a rebuild, provided it meets the sizing requirements for the added roles.