Spanning or mirroring is configured incorrectly

If Network Agent is connected to a switch, it must be able to see all traffic for the network or segment that it monitors. This means that it must connect to the span, mirror, or monitor port (though the term varies by manufacturer, the function is the same).

The span port mirrors all the traffic that leaves the network segment, so traffic is simultaneously sent to the monitoring port to which Network Agent is connected.

Monitor (span, mirror) only the port going to the firewall or router, not the entire network.