Original traffic path
SPAN copy
User / Attacker
Source host
Core Switch
SPAN enabled
Web Server
10.0.0.80
IDS Sensor
Promiscuous mode
IDS monitors a copy of the traffic
The switch mirrors packets to the IDS sensor through SPAN. The original traffic still continues to the server, so IDS detection generates an alert but does not block the packet inline.
PlacementOut-of-band
Packet ControlAlert only
Failure ImpactLow path risk