Skip to content
  • There are no suggestions because the search field is empty.
PROTECTING OVER $1B IN DAILY TRADES
DEFENDING ENERGY FOR 32+M U.S. USERS
SECURING NETWORKS FOR 52K+ TRANSPORT VEHICLES
PROTECTING OVER $10T IN MANAGED ASSETS
SECURING 16+M ANNUAL PATIENT VISITS
+1(888) 547-9497

Product specifications

Appliance sensors

200series-1

AP 220 Appliance Sensor

  • Traffic analysis speeds: Up to 4 Gbps

  • Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1: Up to 2 Gbps

  • Best suited for:
    • Branch offices
    • DNS subnet
    • Critical services or systems
    • VPNs

  • Size and weight: 1U rackmount, (1.75 in x 17.2 x 19.98), 17.6 lbs

  • Monitoring interface: 4 SFP interfaces. Support for copper and optical modules at 100M & 1G

  • Management interface: One 10/100/1000 copper ethernet port

  • External connector: VGA, USB

  • Power: 120/240 VAC 50/60 Hz single 600W Titanium PSU. Approximately 80W usage when idle and 260W usage at load

  • Operational mode: Out of band—fed by tap, span, or packet broker

1 Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

 

Download data sheet
generic-sensor-1000

AP 620 Appliance Sensor

  • Traffic analysis speeds: Up to 10 Gbps

  • Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1: Up to 5 Gbps

  • Best suited for:
    • Branch offices
    • DNS subnet
    • Critical services or systems
    • VPNs

  • Size and weight: 1U rackmount, (1.71 in x 17.3 x 29.27), 19 lbs

  • Monitoring interface: Four 1G/10G SFP/SFP+ modules. Support for copper and optical modules at 1G and/or 10G

  • Management interface: 2x 1Gbe ports 4x 10/25G, SFP28 NIC

  • External connector: VGA, USB

  • Power: 100-240 VAC 50/60 Hz redundant dual 1200W PSUs. Approximately 252W usage when idle and 477W usage at load

  • Operational mode: Out of band—fed by tap, span, or packet broker

  • Additional: Available shunting or deduplication to improve performance in high volume environments

1 Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

 

Download data sheet
generic-sensor-1000

AP 1200 Appliance Sensor

  • Traffic analysis speeds: 25 Gbps

  • Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1: 12.5 Gbps

  • Best suited for:
    • Branch offices
    • DNS subnet
    • Critical services or systems
    • VPNs

  • Size and weight: 1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

  • Monitoring interface: Four 1G/10G SFP/SFP+ modules. Support for copper and optical modules at 1G and/or 10G

  • Management interface: 2x 1Gbe ports 4x 10/25G, SFP28 NIC

  • External connector: VGA, USB

  • Power: 100-240 VAC 50/60 Hz redundant dual 1400W Titanium PSUs. Approximately 241W usage when idle and 1042W usage at load

  • Operational mode: Out of band—fed by tap, span, or packet broker

  • Additional: Available shunting or deduplication to improve performance in high volume environments

1 Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

 

Download data sheet
generic-sensor-1000

AP 3200 Appliance Sensor

  • Traffic analysis speeds: 50 Gbps+

  • Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1: 25 Gbps

  • Best suited for:
    • Science DMZ environments
    • Telecommunication networks
    • High-volume data centers

  • Size and weight: 1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

  • Monitoring interface: Monitoring Interface dependent on SKU selected: Choice of 4x1/10G SFP+, 4x10/25G SFP28 or 2 x QSFP28 supporting 8 x 10G (via breakout cables), or 2 x 40G

  • Management interface: 2x 1Gbe ports 4x 10/25G, SFP28 NIC

  • External connector: VGA, USB

  • Power: 100-240 VAC 50/60 Hz redundant dual 1400W Titanium PSUs. Approximately 276W usage when idle and 1221W usage at load

  • Operational mode: Out of band—fed by tap, span, or packet broker

  • Additional: Available shunting or deduplication to improve performance in high volume environments

1 Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

 

Download data sheet
AP3000

AP 5200 Appliance Sensor

  • Traffic analysis speeds: 125Gbps+

  • Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1: 62.5 Gbps+

  • Best suited for:
    • Science DMZ environments
    • Telecommunication networks
    • High-volume data centers

  • Size and weight: 1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

  • Monitoring interface: 2 QSFP28 modules. Support for optical modules at 8 x 10G, 2 x 40G or 2 x 100G

  • Management interface: 2x 1Gbe ports 4x 10/25G, SFP28 NIC

  • External connector: VGA, USB

  • Power: 100-240 VAC 50/60 Hz redundant dual 1800W Titanium PSUs. Approximately 326W usage when idle and 1359W usage at load

  • Operational mode: Out of band—fed by tap, span, or packet broker

  • Additional: Available shunting and deduplication to improve performance in high-volume or encrypted environments

1 Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

 

Download data sheet

  • Specifications

  • AP 220

  • AP 620

  • AP 1200

  • AP 3200

  • AP 5200

Specifications

AP 220

AP 620

AP 1200

AP 3200

AP 5200

Traffic analysis speeds

Up to 4 Gbps

Up to 10 Gbps

25 Gbps

50 Gbps+

125Gbps+

Traffic analysis speeds - with Zeek, Suricata IDS and Smart PCAP1

Up to 2 Gbps

Up to 5 Gbps

12.5 Gbps

25 Gbps

62.5 Gbps+

Best suited for
  • Branch offices
  • DNS subnet
  • Critical services or systems
  • VPNs
  • Branch offices
  • DNS subnet
  • Critical services or systems
  • VPNs
  • Branch offices
  • DNS subnet
  • Critical services or systems
  • VPNs
  • Science DMZ environments
  • Telecommunication networks
  • High-volume data centers
  • Science DMZ environments
  • Telecommunication networks
  • High-volume data centers

Size and weight

1U rackmount, (1.75 in x 17.2 x 19.98), 17.6 lbs

1U rackmount, (1.71 in x 17.3 x 29.27), 19 lbs

1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

1U rackmount, (1.7 in x 19 x 31.85), 48 lbs

Monitoring interface

4 SFP interfaces. Support for copper and optical modules at 100M &1G

Four 1G/10G SFP/SFP+ modules. Support for copper and optical modules at 1G and/or 10G

Four 1G/10G SFP/SFP+ modules. Support for copper and optical modules at 1G and/or 10G

Monitoring Interface dependent on SKU selected: Choice of 4x1/10G SFP+, 4x10/25G SFP28 or 2 x QSFP28 supporting 8 x 10G (via breakout cables), or 2 x 40G

2 QSFP28 modules. Support for optical modules at 8 x 10G, 2 x 40G or 2 x 100G

Management interface

One 10/100/1000 copper ethernet port

2x 1Gbe ports 4x 10/25G, SFP28 NIC

2x 1Gbe ports 4x 10/25G, SFP28 NIC

2x 1Gbe ports 4x 10/25G, SFP28 NIC

2x 1Gbe ports 4x 10/25G, SFP28 NIC

External connector

VGA, USB

VGA, USB

VGA, USB

VGA, USB

VGA, USB

Power

120/240 VAC 50/60 Hz single 600W Titanium PSU. Approximately 80W usage when idle and 260W usage at load

100-240 VAC 50/60 Hz redundant dual 1200W PSUs. Approximately 252W usage when idle and 477W usage at load
100-240 VAC 50/60 Hz redundant dual 1400W Titanium PSUs. Approximately 241W usage when idle and 1042W usage at load

100-240 VAC 50/60 Hz redundant dual 1400W Titanium PSUs. Approximately 276W usage when idle and 1221W usage at load

100-240 VAC 50/60 Hz redundant dual 1800W Titanium PSUs. Approximately 326W usage when idle and 1359W usage at load

Operational mode

Out of band—fed by tap, span, or packet broker

Out of band — fed by tap, span, or packet broker

Out of band — fed by tap, span, or packet broker

Out of band — fed by tap, span, or packet broker

Out of band — fed by tap, span, or packet broker

Additional

Available shunting or deduplication to improve performance in high volume environments

Available shunting or deduplication to improve performance in high volume environments

Available shunting or deduplication to improve performance in high volume environments

Available shunting and deduplication to improve performance in high-volume or encrypted environments
kl-pricing-table__tab:hover kl-pricing-table__tab--active

1Traffic analysis based on benchmark profile; actual results will vary based on traffic mix

Nominal capacity vCPUs RAM (GB) Disk (GB)
500 Mbps 4 16 500
1 Gbps 8 32 500
2 Gbps 16 64 500
4 Gbps 32 128 1000
6 Gbps 48 192 2000
8 Gbps 64 256 4000
Nominal capacity vCPUs RAM (GB) Workers
1 Gbps 4 16 2
2 Gbps 8 32 4
4 Gbps 16 64 8
8 Gbps 32 128 16
Nominal capacity vCPUs RAM (GB) Disk (GB)
500 Mbps 4 16 500
1 Gbps 8 32 500
2 Gbps 16 64 500
4 Gbps 32 128 1000
6 Gbps 48 192 2000
8 Gbps 64 256 4000

The Corelight Flow sensor should be deployed as a single EC2 instance and not part of an autoscaling group.

The EC2 instance should at a minimum have the following configuration: 4 vCPUs / 16GB RAM / 500GB EBS.