Deploying probes in your network
You need visibility into every corner of the network, from the edge to the core. A distributed analysis solution can provide the coverage you need, but where should you deploy probes for maximum visibility at minimum cost? Because every network is different, the examples shown may not look like your network, but the concepts demonstrated will be applicable to most situations.
Successfully deploying a distributed analysis solution on your network requires that you understand some basic concepts about distributed analyzers and network technologies.
In deploying probes, make sure that you understand the visibility requirements unique to your deployment goals and the design of the network you are analyzing. For 100% visibility of traffic:
Deploy TAPs and specialized high-speed probes on core switch connections to servers, server farms, and other critical network infrastructure.
Deploy less-costly probe appliances on switch monitor (e.g., SPAN/mirror) ports at the edge of your network.
Most commercial packet analyzers, like Observer, are distributed. Packet captures and some analysis are performed by distributed agents called probes, which in turn send the packets (or the analysis results–e.g., bandwidth utilization statistics, most active stations, etc.) to analyzers for further processing and display. Distributed analysis is the only practical way to make different parts of a switched or wireless network visible and therefore manageable. From a single analyzer you can monitor and view traffic from anywhere on the network where a probe has been deployed, from any type of media or topology (Ethernet, wireless, and so on).