Requirements to install the sensor
Last updated: November 10, 2026
The sensor is the Kuntur program that watches your network. You install it on a computer at your company that stays on all the time, and it sends Kuntur only information about what happens on the network, never the content of your files or emails. This page lists everything you need. If you don't have IT staff, you can order assisted installation from the dashboard (Sensors) and we do it with you in a remote session.
1. Summary
| Basic mode | Full mode | |
|---|---|---|
| What it watches | Devices and vulnerabilities on your network, firewall logs and the sensor's own traffic | All of that plus traffic across the whole network |
| Processor | 64-bit, 2 cores (x86-64 with SSE4.2, or ARM64) | 4 cores |
| Memory | 4 GB | 8 GB |
| Free disk | 32 GB | 100 GB |
| Network cards | 1 | 2: one for internet and one for the mirror port |
| Switch | Any | Managed, with a mirror (SPAN) port |
| Maximum traffic | — | Up to 1 Gbps per sensor |
| Power | Always on (24/7) | Always on (24/7) |
A network with several sites needs one sensor per site. You can start in basic mode and move to full mode when you connect the mirror port, without reinstalling.
2. Installation options and supported systems
| Option | Works with | Mode |
|---|---|---|
| One line on Linux | Ubuntu 22.04 and 24.04 LTS, Debian 12 and 13, Rocky Linux, AlmaLinux and Red Hat Enterprise Linux 9 (x86-64 and ARM64). Raspberry Pi 4 or 5 with a 64-bit system | Basic or full |
| Windows installer | 64-bit Windows 10 and 11, Windows Server 2019, 2022 and 2025 | Basic |
| Kuntur OS on a USB stick | Any 64-bit PC from the last 10 years (UEFI or BIOS) that you can dedicate to the sensor. Its whole disk is erased. USB stick of 2 GB or more | Basic or full |
| Virtual machine | Hyper-V (generation 2), VMware Workstation or ESXi, VirtualBox 7 and Proxmox, with the Kuntur OS image | Basic or full |
| .deb or .rpm packages | The same Linux systems, for IT teams | Basic or full |
- On Windows the sensor does not analyze network traffic: it receives your firewall logs and, if you install Nmap (free), finds devices and vulnerabilities.
- On virtual machines, choose the host's processor ("host" in Proxmox): Suricata, the detection engine, needs the SSE4.2 instruction set.
- For full mode on a virtual machine, the second virtual card must be connected to the physical card that goes to the mirror port and accept traffic in promiscuous mode.
3. Network and connections
Outbound to the internet (from the sensor):
| Destination | Port | Purpose |
|---|---|---|
enroll.kuntur.nexelion.us | 443/TCP (HTTPS) | Connect the sensor the first time and renew its certificate |
ingest.kuntur.nexelion.us | 443/TCP (HTTPS) | Send events and receive settings and approved blocks |
kuntur.nexelion.us | 443/TCP (HTTPS) | Download the sensor and its updates |
| Your operating system's repositories | 80 or 443/TCP | Install Suricata, Nmap and security updates |
rules.emergingthreats.net and www.openinfosecfoundation.org | 443/TCP | Suricata detection rules, once a day |
| Your time server (NTP) | 123/UDP | Correct time: the sensor's certificate requires it |
- You don't need to open any port from the internet into your network.
- The connection goes out directly, without an HTTP proxy. If your network only allows outbound traffic through a proxy, write to us before installing.
Inbound (only from your internal network, optional):
| Source | Port | Purpose |
|---|---|---|
| Your firewall and servers | 514/UDP and 514/TCP | Receive their logs (Syslog) |
We recommend a fixed IP address or a DHCP reservation for the sensor, because the firewall will send its logs to that address.
4. Mirror port (full mode only)
A mirror port (SPAN or "port mirroring") is a switch feature that sends a copy of all traffic to one port. The sensor only looks at that copy: if it goes down, your network keeps working the same.
- You need a managed switch. Almost every model from brands like Cisco, HPE Aruba, Ubiquiti, TP-Link Omada, MikroTik, Netgear, D-Link or Fortinet has it.
- Mirror the port that goes to your firewall or router (the way out to the internet) or the network's main link.
- The sensor's port must be as fast as or faster than the mirrored port.
- The sensor card connected to the mirror port has no IP address; the setup wizard configures it.
5. Firewall (optional)
- Logs: any firewall or server that sends Syslog works. Set it to send to the sensor's address, port 514.
- Blocks with your approval (Business plan and up): pfSense, OPNsense, FortiGate and MikroTik. You need an API user with permission only on the Kuntur list or alias. No block is applied unless a person on your team approves it, and every block can be undone.
6. Permissions and people
- An administrator account on the sensor's computer (on Linux,
sudo). - For assisted installation: a person with access to the computer, and the switch and firewall credentials if they are going to be configured. The session takes about an hour.
- An administrator generates the installation code in the dashboard (Sensors). It lasts 24 hours.
7. Notice to your employees
In many countries, monitoring a company network requires telling employees that network traffic is analyzed for security. Do it before you turn on the sensor, as your country's law requires. Kuntur does not store the content of communications, only data about them (addresses, ports, domain names and alerts). Before the first installation code, the dashboard (Sensors) shows a sample notice to copy or download and asks an administrator to confirm the company gave notice; who confirmed it and when is recorded.
8. Verify the downloads
Everything we publish is signed with Nexelion's GPG key. The one-line installation checks it for you. To check it by hand:
curl -fLO https://kuntur.nexelion.us/descargas/SHA256SUMS.txt curl -fLO https://kuntur.nexelion.us/descargas/SHA256SUMS.txt.asc curl -fLO https://kuntur.nexelion.us/descargas/kuntur-release.gpg gpgv --keyring ./kuntur-release.gpg SHA256SUMS.txt.asc SHA256SUMS.txt sha256sum -c SHA256SUMS.txt --ignore-missing
The public key is also at kuntur-release.asc. On Windows, compare the hash with Get-FileHash kuntur-sensor-windows.exe in PowerShell. The Windows installer doesn't carry Microsoft's signature yet: if "Windows protected your PC" appears, check the hash and choose "More info" and "Run anyway".