Chapter 1. Appliance Deployment


E-Detective System records and reconstructs internet content by monitoring network packet. The best way to get data is to deploy the appliance in Switch, Switch Hub, or Hub between network gateway and servers. If you do it right, E-Detective System will provide you complete information.

4 modes to deploy:
1. Mirror Mode
Mirror mode means E-Detective collects data by mirror function which is provided by network equipment. You should have two NICs. One adapter is for collecting date, and the other one is for management. You don’t need to set IP address for the first adapter. It is used for recording data by mirror port. The other one is used for data management. Default IP address is 192.168.1.60. We suggest you use this mode, if the data flow in customer site is large.




2. Broadcast Mode
Network equipment provides broadcasting for E-Detective to collect data. You just need one NIC for recording and management. Default IP address is 192.168.1.60. If data flow is small, you can choose this mode.





3. Bridge Mode
Bridge mode means Internet data should be transfer through E-Detective. This mode should use two NICs and one IP address. It is used for special customer’s environment.





4. Double-Layer Architecture