Hi netuser,
Check this
a) Make sure that you have your SPAN / TAP port configured properly.
b) Ensure that the NIC card connected to the SPAN / TAP port is in promniscous mode.
c) Ensure that the promniscous mode NIC card is selected under System - Servers - Network Monitor server - Configure - Network Interfaces
To confirmed that your SPAN port/network TAP is configured properly? To check this, please install Wireshark on the DLP server and see if you can see all traffic passing through the switch, or just traffic destined to/from the DLP server itself
Also refer below links which will surely help u
https://www-secure.symantec.com/connect/forums/how-setup-network-monitor-dlp-test-environment
https://www-secure.symantec.com/connect/forums/network-monitor-install-details