Sensors can connect to the SPAN port of a switch or to a port on a hub. Most vendors' IDS Sensors are deployed in this manner, and many beginning Trellix IPS users choose to deploy in this mode. The Switch Port Analyzer (SPAN) port is designed for troubleshooting and network analysis so that an attached network analyzer can receive a copy of every single packet that is sent from one host to another through the switch. The SPAN port forwards all incoming and outgoing traffic within the switch to a predetermined port where a Sensor or a sniffer is connected. This is called port forwarding or port mirroring, and it allows an attached device to monitor all traffic of that switch.
When monitoring SPAN ports and hubs, traffic is typically half-duplex. Only one monitoring port is required to monitor each SPAN or hub port. You can send a response back through a hub; if you choose to send a response back through the SPAN port, you can do so if the switch supports transmit back through the SPAN port.
Note
If the switch does not support transmit back through the SPAN, you can send a response via a Sensor response port.