Flows processing takes considerably more horsepower than Intermapper's standard monitoring. In general, we don't recommend using a discarded piece of hardware found under a forgotten desk for Intermapper Flows.
Receiving and processing flows data involves summarizing large volumes of packets; collection and storage is actually not very resource-intensive. At one customer installation, traffic peaks up to 3Gbps, but could be processed with an off-the-shelf laptop, with plenty of CPU time to spare.
The real work for Intermapper Flows is processing queries of stored data. Certain selection criteria can result in asking the server to process millions of records to create a summaries or graph. A large amount of RAM memory for caching session records can speed up processing considerably. Queries going farther back in time require recalling records from disk, and are therefore slower.
As an example, consider a network with a 200MBps border, with 15,000 hosts inside, all serviced by netflow-capable equipment. If you use Intermapper Flows only at the border router, a modest modern desktop, with dual-core CPU and 4GBytes of RAM would do nicely. However, if you turn on NetFlow on each of 1000 Cisco devices throughout the network, some serious hardware might be required: 4 CPUs, several fast disks, and 16GB RAM. Alternatively, you could run multiple copies of Intermapper Flows, each monitoring a subset of flow exporters.
Also, consider the administrators needs. If the administrators want to see only the last hour of data, the desktop might do fine monitoring all 15,000 hosts. If they need the ability to go back in time regularly (to last week, or even last month) expensive, top-of-the-line server hardware might be required.
