Product specifications
AP 200 Appliance Sensor
-
Nominal capacity*: 2 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: One gigE copper ethernet port (1000 Mbps only)
-
External connector: VGA, USB
-
Power: 120/240 VAC 50/60 Hz single PSU. ~83 W usage when idle and 141 W usage at load
-
Size & weight: 1U half-depth rackmount (19 × 14.5 × 1.75 inches), 22 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 1001 Appliance Sensor (No longer available for purchase)
-
Nominal capacity*: 10 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: One 10/100/1000 copper ethernet port; Two 1/10G SFP+ ports
-
External connector: VGA, USB
-
Power: 120/240 VAC 50/60 Hz redundant dual PSUs. 700 W at 110 V or 750 W at 220 V. ~180 W idle, 290 W load
-
Size & weight: 1U rackmount (19 × 25.6 × 1.75 inches), 40 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 1100 Appliance Sensor
-
Nominal capacity*: 20 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: 2 × 1G ports; 4 × 10G SFP+ ports
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~270 W idle, 439 W load
-
Size & weight: 1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 1200 Appliance Sensor
-
Nominal capacity*: 25 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: 2 × 1Gbe LOM ports; 4 × 10/25G SFP28 (OCP NIC 3.0)
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~400 W idle, 600 W load
-
Size & weight: 1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 3000 Appliance Sensor (No longer available for purchase)
-
Nominal capacity*: 25 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: One 10/100/1000 copper ethernet port; Two 1/10G SFP+ ports
-
External connector: VGA, USB
-
Power: 120/240 VAC 50/60 Hz redundant dual PSUs. ~161 W idle, 445 W load
-
Size & weight: 1U rackmount (19 × 25.6 × 1.75 inches), 51 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 3100 Appliance Sensor
-
Nominal capacity*: 35 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: 2 × 1G ports; 4 × 10G SFP+ ports
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~501 W idle, 697 W load
-
Size & weight: 1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 3200 Appliance Sensor
-
Nominal capacity*: 50 Gbps+
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
Management interface: 2 × 1Gbe LOM ports; 4 × 10/25G SFP28 (OCP NIC 3.0)
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~450 W idle, ~750 W load
-
Size & weight: 1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 5000 Appliance Sensor
-
Nominal capacity*: 100 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~443 W idle, 852 W load
-
Size & weight: 1U rackmount (17.1 × 29 × 1.75 inches), 47.4 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
AP 5002 Appliance Sensor
-
Nominal capacity*: 100 Gbps
-
Operational mode: Out of band — fed by tap, span, or packet broker
-
External connector: VGA, USB
-
Power: 100–240 VAC 50/60 Hz redundant dual PSUs. ~443 W idle, 852 W load
-
Size & weight: 1U rackmount (17.1 × 29 × 1.75 inches), 47.4 lbs
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
-
Appliance
-
Nominal capacity*
-
Operational mode
-
Management interface
-
External connector
-
Power
-
Size & weight
|
Appliance |
Nominal capacity* |
Operational mode |
Management interface |
External connector |
Power |
Size & weight |
|---|---|---|---|---|---|---|
|
AP 200 |
2 Gbps |
Out of band — fed by tap, span, or packet broker |
One gigE copper ethernet port (1000 Mbps only) |
VGA, USB |
120/240 VAC 50/60 Hz single PSU. ~83 W usage when idle and 141 W usage at load |
1U half-depth rackmount (19 × 14.5 × 1.75 inches), 22 lbs |
|
AP 1001 |
10 Gbps |
Out of band — fed by tap, span, or packet broker |
One 10/100/1000 copper ethernet port; Two 1/10G SFP+ ports |
VGA, USB |
120/240 VAC 50/60 Hz redundant dual PSUs. 700 W at 110 V or 750 W at 220 V. ~180 W idle, 290 W load |
1U rackmount (19 × 25.6 × 1.75 inches), 40 lbs |
|
AP 1100 |
20 Gbps |
Out of band — fed by tap, span, or packet broker |
2 × 1G ports; 4 × 10G SFP+ ports |
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~270 W idle, 439 W load |
1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs |
|
AP 1200 |
25 Gbps |
Out of band — fed by tap, span, or packet broker |
2 × 1Gbe LOM ports; 4 × 10/25G SFP28 (OCP NIC 3.0) |
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~400 W idle, 600 W load |
1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs |
|
AP 3000 |
25 Gbps |
Out of band — fed by tap, span, or packet broker |
One 10/100/1000 copper ethernet port; Two 1/10G SFP+ ports |
VGA, USB |
120/240 VAC 50/60 Hz redundant dual PSUs. ~161 W idle, 445 W load |
1U rackmount (19 × 25.6 × 1.75 inches), 51 lbs |
|
AP 3100 |
35 Gbps |
Out of band — fed by tap, span, or packet broker |
2 × 1G ports; 4 × 10G SFP+ ports |
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~501 W idle, 697 W load |
1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs |
|
AP 3200 |
50 Gbps+ |
Out of band — fed by tap, span, or packet broker |
2 × 1Gbe LOM ports; 4 × 10/25G SFP28 (OCP NIC 3.0) |
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~450 W idle, ~750 W load |
1U rackmount (19 × 31.85 × 1.7 inches), 48 lbs |
|
AP 5000 |
100 Gbps |
Out of band — fed by tap, span, or packet broker |
|
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~443 W idle, 852 W load |
1U rackmount (17.1 × 29 × 1.75 inches), 47.4 lbs |
|
AP 5002 |
100 Gbps |
Out of band — fed by tap, span, or packet broker |
|
VGA, USB |
100–240 VAC 50/60 Hz redundant dual PSUs. ~443 W idle, 852 W load |
1U rackmount (17.1 × 29 × 1.75 inches), 47.4 lbs |
*Of Zeek-only traffic monitoring. Additional analysis workloads like Suricata IDS or Smart PCAP will reduce sensor throughput speed and performance varies depending on traffic mix.
| Nominal capacity | vCPUs | RAM (GB) | Disk (GB) |
|---|---|---|---|
| 500 Mbps | 4 | 16 | 500 |
| 1 Gbps | 8 | 32 | 500 |
| 2 Gbps | 16 | 64 | 500 |
| 4 Gbps | 32 | 128 | 1000 |
| 6 Gbps | 48 | 192 | 2000 |
| 8 Gbps | 64 | 256 | 4000 |
| Nominal capacity | vCPUs | RAM (GB) | Disk (GB) |
|---|---|---|---|
| 500 Mbps | 4 | 16 | 500 |
| 1 Gbps | 8 | 32 | 500 |
| 2 Gbps | 16 | 64 | 500 |
| 4 Gbps | 32 | 128 | 1000 |
| 6 Gbps | 48 | 192 | 2000 |
| 8 Gbps | 64 | 256 | 4000 |
| Nominal capacity | vCPUs | RAM (GB) | Disk (GB) |
|---|---|---|---|
| 500 Mbps | 4 | 16 | 500 |
| 1 Gbps | 8 | 32 | 500 |
| 2 Gbps | 16 | 64 | 500 |
| 4 Gbps | 32 | 128 | 1000 |
| 6 Gbps | 48 | 192 | 2000 |
| 8 Gbps | 64 | 256 | 4000 |
The Corelight Flow sensor should be deployed as a single EC2 instance and not part of an autoscaling group.
The EC2 instance should at a minimum have the following configuration: 4 vCPUs / 16GB RAM / 500GB EBS.