I'm setting up DLP Monitor for a client and running into issues with DLP Monitor. I set it up this morning and only seeing 11 MB of HTTP traffic all day. I've been surfing all day too and the number hasn't grown by as much as I'd think. We have HTTP selected and the correct interface under server configure.
We have the switch mirroring traffic going to their internet interface and sending it to the DLP Monitor appliance on NIC 2. We verified the traffic is being monitored by setting up a filter on Wireshark sourcing my laptop and going out to the internet. The traffic is being seen on the interface we have monitored so the span is setup correctly.
Under Traffic:
HTTP
Data: 11.76 MB
Messages: 3,334
Incidents: 0
Encrypted Attachments: 0
Unprocessable Components: 0
Is this indicative of ~100 users internet traffic for a day? I might be misunderstanding the number but if it's a quantity, then it is off by 100's of MBs.