TMS zl Management and Configuration Guide ST.1.0.090213

3-4
Initial Setup in Monitor Mode
Overview
Figure 3-1. Logical Operation of TMS zl Module in Monitor Mode
In Figure 3-1, the TMS zl Module’s host switch receives traffic from directly
connected devices, which can be endpoints or other switches. The switch both
forwards the traffic to its destination and mirrors the traffic to the module
data port. Both intra-VLAN and inter-VLAN traffic can be mirrored. When the
module receives the traffic, its IDS inspects the traffic, logging any events
(such as detected attacks) and also sending a notification depending on the
severity of the event and user-configured settings.
Figure 3-2. Logical Remote Mirroring Operation of
the TMS zl Module in Monitor Mode