When deploying an offline sensor, are two physical NICS required?

Question

If deploying a standalone, offline sensor on Hyper-V using PCAP files instead of a SPAN port, are two physical NICS required on the host, or is it possible to set one up as a virtual private switch?

yossit · Answer

&nbsp;
The sensor requires 2 vNICs - one for management and connection to the console and the second for traffic monitoring.
If you are using only internal PCAP player you can use the monitoring vNIC (in "connected" mode) without bridging it to physical port
mtelatnik&nbsp;

Forum Discussion

When deploying an offline sensor, are two physical NICS required?

1 Reply