Do the network sensors support multiple interfaces for traffic capture? Couldn’t find anything around this in the documentation.
The devices that act as our “core” switches are in a HA pair, if we wanted to capture traffic from both devices in the event of a failover, could we have two physical connections going from the pair to the network sensor device?
Or am I thinking about this wrong?
A sensor can only be configured with a single capture interface. What you could do is install ESX as a base on the host device. Then run two virtual sensors. Each sensor can have its own connection back to the HA pair.
Actually I think if you have a management switch, you should be able to pipe both span or mirror ports into the management switch and pick up multiple sources via a single interface, or redirect those sources to appropriate interfaces. a packet broker would help here too. depends on your hardware and budget of course!