I'm working on creating a stand-alone network agent vm. According to this KB article (http://www.websense.com/support/article/t-kbarticle/v7-Where-does-Network-Agent-fit-in-my-network-1258048450313?popup=true) you need to have mirror or span port enabled on the physical port on the switch that the monitor NIC is plugged into.
The only thing that span port does is allows the node connected to that port to see other traffic. But it does not allow you to do anything with that traffic. So I am wondering why does the span port need to be enabled? Or, has anyone got this to work without enabling the span port?
Thank you