If everything is VMs, then you can run a VM which taps into the network traffic of everything else. Otherwise, just find a switch that can give you "mirror port" functionality and mirror the uplink port to your separate box. Using an SSD for primary capture which you then copy to the existing RAID box you have would be the cheapest. all IMHO. Cheers, Patrick