The architecture of Moloch enables it to be distributed on multiple devices. For small networks, demonstrations or home deployment it is possible to host all the tools necessary on a single device; however, for capturing large volumes of data at high transfer rates it is recommended not to run Capture and Elasticsearch on the same machine. Moloch allows for software demo version testing directly on the website. In case of storage space shortage, Moloch replaces the oldest data with the new. Moloch can also perform replications, effectively doubling storage space usage. We advise to thoroughly think through the use of this feature.
Amount of nodes(servers) to be used depends on: