Monitoring Mode provides a way to access data flowing across a network. Deploying in Monitoring Mode allows administrators to passively monitor traffic through a switch SPAN or mirror port.

The SPAN or mirror port permits copying traffic from other ports on the switch. By dedicating an interface on the firewall as the "Monitoring Mode" interface and connecting that interface with a switch SPAN port, the switch SPAN port provides the firewall with the mirrored traffic. This provides application visibility within the network without being in the flow of network traffic.