An appliance for analyzing a network interaction is disclosed. The appliance includes an input to monitor network traffic that includes a network interaction without interfering with the network traffic. The appliance further includes a processor to analyze network traffic to derive information about the network interaction wherein the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user.