The design of a distributed traffic capture system is based on the requirements of the monitoring devices. Commonly used monitoring equipment are: intrusion detection/prevention systems, performance monitors, service assurance tools and data recording devices. Each of these devices may need to see only certain slices of traffic -- such as HTTP, voice, video, signaling, virtual LAN data and/or payload -- and from only selected network segments or the entire network.

Design criteria that network engineers should take into account include:

* The number of networks being monitored.

* The media is copper, fiber or mixed.