Passive monitoring

Two ways to feed a passive monitoring sensor: a SPAN (port mirroring) configuration on a production switch and a passive network TAP, each sending receive-only capture traffic to a sensor whose separate management port reaches a monitoring console in the DMZ through a firewall, with notes on fail-open TAP behavior and capture loss.