When monitoring a SPAN or hub port, Sensors with internal taps are disabled.
Note
Trellix recommends connecting cables to your Fast Ethernet ports with fail-closed dongles if deploying in SPAN or Hub mode.
In the following figure showing an M-6050 Sensor, Port 1A receives data from the SPAN port of SwitchA. Port 1B gets data from the SPAN port of SwitchB. Two distinct network links from two separate switches are monitored by the one active M-6050 Sensor with a 2.5 Gbps rate per link to the Sensor, allowing a total of 5 Gbps traffic to the IPS engine.
.png)