Fanless mini pc

[wsrivon]

do not understand architecture... but looked at https://docs.securityonion.net/en/2.3/hardware.html
still wondering if security onion would install and run well based on the specs below

CPU: Intel Core i7-1165G7 Processor (12M Cache, up to 4.70 GHz)
AES-NI Supported: Yes
Memory: 2 x sodimm ddr4-3200, max. 64g ram
Storage: 1 x M.2 NVMe PCle3.0 x4 2280 SSD, 1 x 2.5 inch sata SSD/HDD
Network Card: Intel 2.5GbE I226-V
I/O Interface: RST, Power ON/OFF, 4 x USB3.1, COM, HDMI, DC_IN, 6 x LAN
Expansion: Mini PCIE usb signal for WiFi/4G, with sim slot (contact us to customize)
Power: Dc100-240v ac/50-60hz, 12v-19v/ 12v10a

Thanks

[TotieBash]

I assume you want to configure SO as single "Standalone" configuration. Personally, I would test and use it for small use case with average throughput around 500Mbps max. I think the bottleneck here would be the SSD. Also the question is how much data retention you want, very rough math 500Mbps is equals to 5,000MB/day (5.4GB to be exact). I would dedicate one SSD for the OS data and the second one purely for the SO /nsm data.

In summary, it should work but test test test. The hardware looks cheap enough to quickly acquire and standup a quick POC. I would use ntap network taps to conduct the POC on live networks so you can just easily insert the ntap on any ethernet network. That is the best way to conclude if its going to work on the network you are trying to monitor with SO.

https://www.ebay.com/itm/115647774468

[wsrivon]

https://www.ebay.com/itm/256104879982
Think I got the wrong one.. not sure what R87 is for.

[TotieBash]

Yes, you got the wrong one but it will still work. The one I sent you is an aggregator. The first and second ethernet port is for the tap point for normal traffic. The 3rd and the 4th port is where the monitor port. In which you just need 1 single port to get transmit/receive of the traffic. You just need either the 3rd port or the 4th port to get a copy of tx/rx of the traffic. So you can have SO on port3 and another monitoring solution on port 4.

The one you bought will work but know that you have to cable both port3 and port4 to get the full tx/rx of the traffic. You need to send both port 3 and 4 to SO.

[dougburks]

For others that may run across this discussion, we link to some inexpensive tap/span options at:
https://docs.securityonion.net/en/2.3/hardware.html#packets