document updated 15 years ago, on Nov 25, 2008
Passive monitors are useful for several reasons:
- Active monitors require you to already know something about the network, or to guess. Passive monitors figure out all information they need.
- Active monitors, when detected, are usually considered unwelcome activity, by default. Passive monitors aren't detectable (for the most part).
Passive only
- mainly lists hosts
- mainly lists sessions, and traffic amount
Can operate either in passive mode, or in active mode