In standard mode the sensor receives a copy of the traffic from a mirrored switch port (SPAN) or a TAP: it is not on the data path. Inline (an IP-less bridge between router and switch) is available for evaluations, with the client's written consent, because a power loss or a sensor failure interrupts the link.
Traffic is copied to the sensor. The process notices nothing, whatever happens to the sensor.
Software bridge without an IP address; forwarded traffic never touches the packet filters. Measured at our office: 0 frames emitted by the sensor in 120 s, 0 packets dropped, ports at 1000/full.
The sensor is managed only through its own 4G modem and a dedicated encrypted tunnel; it asks nothing from the client's network.