Skip to content
SOC for OT

Glossary

Passive network monitoring

Also known as: Passive OT monitoring, SPAN/TAP monitoring

Passive network monitoring analyses copies of network traffic — taken from SPAN ports or network TAPs — without sending any packets into the monitored network.

By Last updated:

A SPAN (mirror) port copies traffic from a switch; a network TAP is a hardware device inserted in a link that copies traffic without depending on switch configuration. Sensors decode industrial protocols to build an asset inventory, learn normal communication patterns and detect suspicious activity.

Because nothing is sent into the control network, passive monitoring carries no risk of disturbing fragile controllers — the main reason it is the default telemetry source for a SOC for OT.

← All glossary terms