There are multiple ways that network traffic can be monitored or blocked by security sensors.
The most effective way is in line at this technique.
Traffic flows directly through security devices allowing it to inspect and block malicious traffic.
The only downside to online mode is that data throughput is impacted significantly since each packet
is inspected before being forwarded.
A less aggressive way to gain network visibility is tap mode.
In tap mode only copies of traffic are redirected to security devices so malicious traffic can be monitored
but not blocked.
To redirect traffic to a tap port Port mirroring is used with span spans sweats pore analyzer can be
configured on switches to instruct the switch to send copies of traffic from certain source villans
or interfaces to a span destination port connected to a tap a fairly new way of gaining visibility for
security appliances is with net flow net flow is a network protocol developed by Cisco for collecting
IP traffic information and monitoring network traffic traffic learned by nut flow can be sent to remote
monitoring devices for collection with UDP packets by analyzing flow data.
A picture of network traffic flow in volume can be built with this kind of rich data security monitoring
systems can get a full spectrum of network and security issues.