When deploying an offline sensor, are two physical NICS required?

Copper Contributor

If deploying a standalone, offline sensor on Hyper-V using PCAP files instead of a SPAN port, are two physical NICS required on the host, or is it possible to set one up as a virtual private switch?

1 Reply


The sensor requires 2 vNICs - one for management and connection to the console and the second for traffic monitoring.

If you are using only internal PCAP player you can use the monitoring vNIC (in "connected" mode) without bridging it to physical port