2 Replies Latest reply on Feb 9, 2016 10:39 AM by cylefangmeier

    RSD and winpcap question


      Simply, I am researching the RSD product to deploy in a large environment, but I need to minimize the number of RSDs on the net. I plan on employing a passive RSD monitoring system using span ports, but this intended span-port-machine is also used for packet capturing. My confusion comes from the documentation I have found on RSD which, to me, says contradicting things.

      The Product Guide for "McAfee Rogue System Detection 5.0.0" states on page 9:


      1)"You cannot deploy the Rogue System Sensor to a system that is running WinPCap or any software using WinPCap. If WinPCap is installed, the sensor installation stops and logs an  error message. If you install WinPCap on a system that already has a sensor installed, it can cause the sensor to stop functioning properly."


      However, the same document also states on page 21:


      2) "To detect systems on the network, the sensor uses WinPCap, a packet capture library."


      So is this the difference between active and passive monitoring? Can someone please clarify?