is the network sensor supposed to installed on the workstation that serves as the mirror destination? Any idea how?
Short answer - yes, you need two NIC's. These days people use a laptop with the span port using the wired connection and the "regular" network running over wireless. But either way, yes. You can't capture traffic AND communicate on the same switch port.
Indeed, an NPAS would be installed on a system serving as a mirror destination. The below document should assist as well:
http://www.solarwinds.com/documentation/Orion/docs/SolarWindsPacketAnalysisSensorDeploymentGuide.pdf
Hi Rob,
Thanks for the link. I already read this doc but still confuse because the sensor is not separate but is integrated to NPM which is installed on the Poller Engine and the Poller engine talks to the Orion database. I have a workstation as a mirror destination. since QoE Sensor is not a separate component, how do I get to install it on the workstation
Thanks again
Firstly, we would want to deploy a Network Packet Analysis Sensor to the workstation:
Once complete, we would specify nodes and applications to sniff for. If you upgrade to 11.5 RC, we now have application and node detection: Quality of Experience - Now with Application Discovery
I got this going but the QoE dashboard is blank with "Data is Not Available". The workstation can talk to the poller Engine server. I ran wireshark on both the server and workstation; I can traffic coming through the mirrored port. I opened a case and was on the phone for 1:15hrs, the Agent/rep confirmed setting all OK yet no data is display on dashboard. Would you have an idea of possible cause and how to resolve this?
Thank you
Glory
This video from SolarWinds Lab may also get you started... https://www.youtube.com/watch?v=u8YjDgSXWD8
This one also has some good details: https://www.youtube.com/watch?v=4yfrQz2TyyU
Thanks Leon. The videos are helpful and I have a question....
My Windows7 Ultimate Workstation is on the network domain. it is connected to cisco 3750 switch. When I configured Local SPAN monitor session on it, I lost connection to the workstation( monitor session destination device) and the Orion server can't talk to it anymore. However, when I issue the command monitor session 1 destination interface gigabitethernet10/20 ingress dot1q vlan 2, the workstation becomes reachable. So, I deploy the sensor and nodes to monitor with specified applications but no data is getting displayed on the QoE dashboard. My question is, does my workstation need to have 2 NIC cards: One that connections to the Orion server and one that connects to the Switch mirrored port? How do I get Orion Server to talk to it without add the option ingress dot1q vlan 2?
I was hoping with the sensor install on the Workstation, Orion should be able to talk to the PC. Please advise, thanks!
This workstation is not on the internet. My only concern is that it stops talking to the Orion Server as soon as the destination session command is issued. My question was: does my workstation need to have 2 NIC cards: One that connections to the Orion server and one that connects to the Switch mirrored port?
Both the workstation and Orion server sit on the same IP subnet and connects on the same switch that is being mirrored. So, when I issued "mirror session 1 destination command, Orion lost connection to the workstation