we've upgraded our NPM and are now looking to take advantage of QoE. I have installed the agent on a new windows server and I have a span port set up on our core switch with the destination of the span being a 2nd NIC on this new sensor. It is seeing traffic and has automatically 'added' 50 nodes under the sensor, but it seems as if it will only 'add' nodes or display traffic if it originates or terminates on an NPM-monitored device (which in our case is all routers)? Is this correct?
Basically I'm seeing stats after 24hours, but the bulk of it is SSH and SNMP data... despite the fact that the agent is getting copies of every packet that transits one of our small remote links (with around 50 sites) where I know there is data such as SQL, Citrix and so on transiting our network.. from various desktop computers talking to our server farm (none of which are in Solarwinds, as like most companies, our server team use SCOM to monitor their environment and not solarwinds)
I assumed that once if we used a 'network' agent with a span, this would just process and display data on anything it sees?
Not sure if this will help with the diagnosis but we have a tool called LANGuardian which can also connect to a SPAN port. There is a 30 day trial available on our website so you could use this to see what sort of data is coming out of your SPAN port. LANGuardian does not use any filters on what devices to monitor. You don't need to use the LANGuardian web interface as you can view the data outputs through Orion. An example of this is shown on our online demo.
Hope this helps,