Do I need a hardware appliance on every site?

No NetSenX appliance is needed: the agent is software that runs on a host you choose. One agent connected to a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port watches the whole segment and counts as one device.

This answer also appears, with more context, here: OT network monitoring

Read next

Terms used here

SPAN (switch port analyser)
A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
TAP (test access point)
A small device that copies the traffic on a network cable for a sensor to watch.

← All 50 questions on OT and IoTAll topics