Configuring receipt of mirrored traffic from SPAN ports

If you are using the distributed solution and multitenancy mode, use the web interface of the PCN or SCN server for which you want to configure parameters.

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

To configure receipt of mirrored traffic from SPAN ports:

1. Select the Sensor servers section in the window of the application web interface.

   The Server list table will be displayed.

2. Select the Sensor component for which you want to configure the receipt of mirrored traffic from SPAN ports.

   This opens the Sensor component settings page.

3. Select the SPAN traffic processing section.

   The Network interfaces table is displayed.

4. In the row of the network interface from which you want to configure the receipt of mirrored traffic, set the toggle switch in the SPAN traffic scanning column to Enabled.
5. In the Capture thread drop-down list, select the stream that will process this network interface.
6. In the Select CPU drop-down list, select the processor that will process the network traffic.
7. Click Apply.

The receipt of mirrored traffic from SPAN ports will be configured.