A tap--internal or external--is a passive wiring device that copies traffic on full-duplex Ethernet segments, and sends this copied traffic information to the S processors for analysis.
Full-duplex taps split a link into separate transmit and receive channels. Sensors provide multiple monitoring interfaces to monitor the two channels, and Sensor ports are wired in pairs in order to accommodate full-duplex taps. Two monitoring ports are used to monitor one full-duplex link using a tap.
The benefits to using Sensors in tap mode are:
Monitor uplinks passively -- Taps cause no latency in your network traffic. You essentially sniff traffic as it passes.
Traffic continues to flow if the tap fails -- Completely passive and fault tolerant, taps provide fail-safe operation with no impact on network connectivity or performance. Taps fail open, meaning that a failed Sensor permits traffic to continue to flow unimpeded.
The downside of tap mode is that, unlike in-line mode, you cannot prevent attacks. Tap mode is passive; the Sensor essentially sees malicious traffic as it passes, so sensing an attack in tap mode triggers a response post-attack. You also cannot inject response packets back through a tap; the Sensor provides Response ports to inject response packets.
.png "GUID-CA9EFBCA-AA85-4F29-83CC-CEA770AFAB12-low.png")