I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network.
My question is, do any of these modes allow for packets coming out from the sensor machine to traverse the network.
- SPAN port
- Inline mode
- Tap mode
If not how else can you monitor traffic passively using a sensor that runs fprobe and pushing flow to a computer with a known ip address that collects all data?