If you missed the 11.5 beta, you may not have noticed a subtle, but important new feature in the Quality of Experience dashboard: Application Discovery.
Application Discovery allows QoE sensor to automatically detect ~1400 known applications as well as perform URL parsing for HTTP applications:
So why is this a big deal? Previously you had to define which applications to sniff for. Now besides simplifying the sensor process, in combination with the new alerting engine in 11.5, you can now detect and alert on malware or unwanted cloud applications:
Perhaps a little bit of cloud-storage provider activity is permissible in your environment, but if a couple gigs leave it could trigger data ex-filtration concerns? Done:
URL parsing also has interesting security implications. Perhaps there is new botnet C&C we want to validate our servers aren't checking in with. A quick report can give us piece of mind:
To deploy QoE agents, simply define the endpoints you want to monitor as managed nodes. For DHCP client ranges, you would likely want to setup scheduled discoveries, and would need to add clients on a recurring basis.
Once managed, you could either deploy sensors to the endpoint, or monitor via SPAN/Tap. Would the constraint of clients having to be managed prevent you from deploying? Please let us know in the comments below. If you're not familiar with QoE agent deployment, check out the deployment guide here.
If you're not yet on 11.5 RC, and are on active maintenance- log into your Customer Portal to download.