Probe (Sonda)

In networking, a probe is a device or program that watches network traffic at a chosen point in the network, analyzes it, and passes the result on — as flow records (condensed summaries of connections), metadata, or full packets. A probe does not create the traffic and is not a full copy of it. It is an analysis tool that works on data delivered to it from elsewhere: through a switch mirror port (SPAN) or a tap inserted into the link (TAP). In network performance monitoring (NPM) and network detection and response (NDR), the probe collects the telemetry on which the upper correlation and detection layers run.

How does a network probe work?

A probe receives a copy of the traffic, breaks it down layer by layer, and extracts what upstream systems need. Depending on its settings, it can go to different depths:

• Headers and flow metadata — the probe groups packets into flows described by IP addresses, ports, protocol, timing, and data volume. It exports them as NetFlow, IPFIX, or sFlow records. This is a compact record of who talked to whom and how much data moved, without the content itself.
• Application metadata — deeper inspection (DPI, deep packet inspection) can pull out things like DNS queries, HTTP headers, or TLS connection-setup parameters and certificate details — all without storing the full packet payloads.
• Full packets — in full packet capture mode, the probe stores all the traffic, for example to PCAP files, for forensics and compliance.

There is one important limit: a probe is only as good as its traffic source. If the capture point drops packets or discards errored frames, the probe cannot rebuild what it never received. That is why how you feed it the traffic (TAP, packet broker) matters as much as the probe itself.

What types of probes are there?

Probes differ in what they are for and how deeply they analyze traffic:

• Performance probes (NPM) — measure application response time, latency, jitter (variation in delay), and packet loss.
• Flow probes — generate NetFlow/IPFIX/sFlow records for traffic-pattern and bandwidth analysis.
• Security probes (NDR/IDS) — look for signs of a break-in, unusual behavior, and rule violations, both in traffic between servers (east-west) and at the edge with the internet (north-south).
• Protocol analyzers — help find the cause of connectivity problems and service misconfiguration.
• Full packet capture probes — record all the traffic for forensic and evidentiary use.

In practice a single probe often does several jobs at once — for example, exporting flows while also pulling out application metadata for threat detection.

Passive vs. active probe — what is the difference?

It comes down to where the probe gets its data:

• A passive probe only observes real traffic. It does not change it and does not add packets of its own. It shows faithfully what is really happening on the network under genuine load. It is also invisible to an attacker, because it sits off the data path, not on it.
• An active probe sends its own test traffic (queries, transactions, pings) and measures parameters the way a user would experience them. It is useful for availability tests, SLA checks, and end-to-end measurement, including when there is little real traffic.

A note on naming: there are also “passive” and “active” TAPs, meaning taps at the cable level (an unpowered optical splitter versus a powered circuit that boosts the signal). That is a different split from passive versus active data collection by a probe.

How is a probe deployed: TAP, SPAN, and packet broker

A probe needs access to a copy of the traffic. There are two basic ways to give it that copy:

• A SPAN (mirror) port — a switch feature that copies selected traffic to a separate port. Cheap and flexible, but under heavy load it drops packets, usually discards errored frames, and supports a limited number of sessions.
• A TAP (Test Access Point) — a hardware tap inserted into the link that delivers a physical copy of 100% of the traffic, including errored frames. A TAP has no IP or MAC address and is invisible to the network, so it is hard to spot and tamper with.

A typical setup has three layers. The TAP pulls traffic from the link, the packet broker (a device that distributes traffic) collects, filters, and hands it out to tools, and the probe analyzes its assigned stream. Probes are placed where traffic converges: at the internet edge or the exit to the cloud (north-south traffic) and inside the data center, between servers (east-west traffic). In virtual and cloud environments, the probe’s role is played by virtual sensors (VMware, KVM, Hyper-V) or sensors for AWS, Azure, and GCP that draw on virtual TAPs and flow logs (VPC Flow Logs, NSG flow logs).

How does a probe differ from a TAP?

These are two different layers that are easy to confuse:

• A TAP is the access layer — its job is to deliver complete traffic. It is passive, does not analyze content, and has no network address.
• A probe is the analysis layer — it interprets the delivered traffic and generates flows, metadata, or alerts. It has an IP/MAC address for management and needs configuration and updates.

In short: the TAP makes sure you have complete data; the probe turns that data into usable metrics and detections. The best visibility comes from combining both (and with multiple links, a packet broker as well).

Why do probes matter for security?

Probes are the foundation of network visibility, which is what NDR and network traffic analysis (NTA) rely on. Detection on the network side is hard to evade: an attacker who disables an endpoint protection agent (EDR) on a computer still generates traffic that a passive probe can see. From the metadata a probe supplies, detection systems build a picture of normal network behavior and flag departures from it, such as:

• command-and-control traffic and beaconing — regular, small outbound connections by which a compromised computer “checks in” with the attacker;
• data exfiltration — an unusual amount or direction of transferred data;
• lateral movement — an attacker hopping from computer to computer inside the network;
• anomalies in DNS (for example tunneling), in TLS certificates, or in application headers.

Because a probe usually works off the data path, it is hard for an attacker to detect and disable. That makes its telemetry a trustworthy source for the SOC. Full packet recordings from capture probes, in turn, support post-incident investigations and meet evidentiary requirements.

Learn more

• Cloud Security Posture Management (CSPM) — A probe can collect cloud configuration and activity data used by CSPM tools.
• SaaS Security Posture Management (SSPM) — A probe can gather SaaS telemetry that helps SSPM assess app security posture.
• Data Loss Prevention (DLP) — A probe can inspect traffic or logs to detect data transfers relevant to DLP.
• BYOD (Bring Your Own Device) — A probe can monitor BYOD devices’ network activity without installing agents.
• NSM (Network Security Monitoring) — A probe is the sensor that captures network data for NSM analysis.
• Cyber Kill Chain — A probe can provide network evidence of attacker actions at each kill chain stage.
• Incident Response Lifecycle — A probe supplies telemetry used to detect, investigate, and contain incidents.
• SIEM — A probe feeds event data into SIEM systems for correlation and alerting.