1. An appliance for analyzing a network interaction, comprising: an input to monitor network traffic that includes a network interaction without interfering with the network traffic; and a processor to analyze network traffic to derive information about the network interaction wherein the information about the network interaction is used to distinguish whether the network interaction is a qualified network interaction with a user.