The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

SPAN port and hub monitoring

Prev Next

When monitoring a SPAN or hub port, Sensors with internal taps are disabled.

In the following figure showing an NS9500 base Sensor model, Port G0/1 receives data from the SPAN port of SwitchA. Port G0/2 gets data from the SPAN port of SwitchB. Two distinct network links from two separate switches are monitored by the one active NS9500 Sensor with a 5 Gbps rate per link to the Sensor, allowing a total of 10 Gbps traffic to the IPS engine.

SPAN port monitoring
SPAN Port Monitoring