Inline or Monitor? — TechKnowSurge

About this interactive

A security device can cause more trouble than it solves if it is set up wrong, so two choices matter: passive or active (warn, or act), and inline or monitor. Inline means all traffic goes through the device, with no chance to bypass it. A firewall must be inline, and an IDS or IPS can be: then it makes decisions just like a firewall and can drop a packet before it goes any further. The cost is that if it goes offline, it can bring the whole network down with it. Monitor means the device sees a copy of the traffic instead, from a tap or a switch port the traffic is replicated to. It analyses what it sees and decides what to do. An IDS fits this naturally. An IPS on a monitor connection can still stop an intrusion, by telling the firewall to add a rule or by responding to the traffic, but the original packets have already gone on their way. And if a monitor device fails, traffic carries on: only the watching stops.

What you'll learn

Tell an inline device, which all traffic passes through and which can stop a packet itself, from a device on a monitor or tap connection, which works on a copy of the traffic
Weigh the trade-off: an inline device that fails can bring the network down, while a monitor device that fails leaves traffic flowing; a monitor-mode IPS can still stop an attack by telling the firewall to add a rule

Aligned to

CompTIA Security+

3.2 Given a scenario, apply security principles to secure enterprise infrastructure.

4.5 Given a scenario, modify enterprise capabilities to enhance security.

Key terms

Inline Deployment: A network placement mode where all traffic passes directly through the security device, allowing it to enforce policy but risking network outages if the device fails.
Monitor/Tap Deployment: A network placement mode where a security device receives a copy of traffic for analysis without sitting in the direct traffic path, preserving network availability if the device goes offline.
Port Mirroring: A switch feature that copies all traffic from one port to another port so that a monitoring device can analyze network traffic without disrupting normal operations.
Passive Security Configuration: A device mode that monitors network activity and generates alerts without taking direct action to block threats.
Active Security Configuration: A device mode that monitors network activity and automatically takes action to block or stop detected threats.

Topics

Inline Deployment Monitor Tap Deployment Port Mirroring Network Tap Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →