Step 2: Configure a Network Traffic Source
After deciding where to locate your Insight Network Sensor on your network, configure the network traffic source that the network sensor will connect to.
For supported traffic configuration options, see the Network Requirements for Network Sensor Deployment page.
Physical Traffic Sources
A mirror port-equipped core switch is the preferred physical traffic source configuration option. If you need an alternative, deploy a Test Access Point (TAP) or a Network Packet Broker (NPB).
NOTE - Consult your device manufacturer documentation
Since all traffic source configuration procedures vary by product, make sure you consult your device manufacturer documentation for setup guidance.
For your convenience, we’ve provided the following Wireshark switch reference that can help you find relevant traffic source documentation per your device manufacturer:
https://wiki.wireshark.org/SwitchReference/
Virtual Traffic Sources
All virtual network sensor deployments require a virtual traffic source configured on your ESXi host, and you can implement this virtual traffic source by configuring an ESXi virtual switch to run in “promiscuous mode.” Promiscuous mode allows connected controllers to receive all network traffic moving along a virtual switch beyond what its default programming allows, thus creating a virtual network traffic source for the network sensor to use.
As covered on the Network Requirements for Network Sensor Deployment page, your monitoring intentions will determine whether you will also need to configure any additional virtual switches along with a physical traffic source to accommodate your physical infrastructure.
TIP
You can complete the virtual switch promiscuous mode configuration that will create your virtual traffic source at the same time that you deploy your virtual network sensor host. If you only intend for your virtual network sensor to monitor the east-west traffic on your ESXi server, proceed to Step 3: Provision a Network Sensor Host.
However, if you intend for your virtual network sensor to also monitor your physical infrastructure, you’ll need a physical traffic source to account for this. Make sure you configure this physical traffic source before moving on to the next step.