According to one general aspect, a method may include establishing at least a first and a second network tap point near, in a network topology sense, an intranet/internet access point device and a server computing device, respectively. The method may include monitoring, via the first and second network tap points, at least partially encrypted network communication between a client computing device and the server computing device. A second network tap point analyzer device may decrypt at least a portion of the encrypted network communication that is viewed by the second tap point analyzer device. The method may include analyzing the monitored encrypted network communication to generate a set of metrics regarding the performance of the network communication between the client computing device and server computing device. In some embodiments a plurality of tap points and tap point analyzer devices corresponding to a multitude of network segments may be employed.