Monitoring Mode provides a way to access data flowing across a computer network. Deploying in Monitoring Mode allows Administrators to passively monitor traffic through a switch SPAN or mirror port.

The SPAN or mirror port permits the copying of traffic from other ports on the switch. By dedicating an interface(s) on the firewall as the "Monitoring Mode" interface(s) and connecting that interface(s) with a switch SPAN port, the switch SPAN port provides the firewall with the mirrored traffic. This provides application visibility within the network without being in the flow of network traffic.