CloudShark can run on both virtual machine (VM) and pure hardware installations in a variety of configurations. Below are some sample configurations and their recommended maximum capture file sizes.
All tiers must have a 64-bit (x86_64) CPU and Gigabit Ethernet (or faster) network connectivity.
Because your individual usage of CloudShark is very specific to your organization, and so much depends on the contents of the capture files as well as the number of concurrent users you have accessing CloudShark, we’ve put together the following table to give you an approximate performance level.
|Max File Size||Up to 200 MB||Up to 1.5 GB||Up to 4 GB|
|Number of Users||1-5||up to 25||> 50|
For example, if you only have 3-5 users, and open files around 1 GB, then the Better tier is probably sufficient. However, even if you only have a few users but still need to open files > 2 GB, you should still opt for Best.
Some analysis tools are more intensive on the CPU and disk than others and may take longer depending on the content and size of the capture file. Suggested sizes are estimates only.
Analysis tools are still capped at what can be completed in a reasonable amount of time. To run some tools and filters against larger files, your hardware will need to be powerful enough.
Note that CloudShark’s storage requirements grow linearly with the size of the capture files stored. Many CloudShark deployments use existing SANs within an organization. For local storage, we recommend a redundant storage array and ext4 filesystem with high performance disks.
CloudShark can be sufficiently evaluated when installed directly onto a system in the Good tier, or as a virtual machine running on a host system in the Better tier.
CloudShark runs on a standard 64-bit (x86_64) Linux machine. The following operating systems are currently supported:
All installation types, such as minimal install, full desktop install,
etc. are supported. We recommend a minimal install of the latest release
and all available security updates. To update the system, run the
Please note that Red Hat Enterprise Linux may require the configuration of an optional software channel to fully support all of CloudShark’s dependencies. CloudShark’s installer will generate a warning if this channel is disabled.
For rapid deployment of CloudShark we’ve also created an OVA image based on CentOS. The CloudShark OVA is a pre-installed Linux system that boots directly into the CloudShark installer. It is the easiest way to get CloudShark running for individuals unfamiliar with Linux.
CloudShark supports running on any instance type that is Amazon EBS-Backed. For the best performance choose the Compute Optimized C4 instance type. It is also possible to run on the General Purpose T2 instance type, however, this is better suited to trials or single user CloudShark instances.
The Good, Better, Best tiers described above can be mapped to the Amazon EC2 Instances based on the amount of vCPUs and Memory that they provide.