The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

SPAN or tap mode

Prev Next

Ports in SPAN mode do not provide a Sensor with the same physical means to determine direction. In the case of SPAN mode, for example, traffic is mirrored from a switch to a single Sensor monitoring port, so a Sensor cannot easily differentiate inbound traffic from outbound.

How the Sensor determines direction and VIDS ID in SPAN mode depends on the interface type in question.