Nothing for the process: the sensor receives a copy. On power loss, reboot or hardware failure you only lose visibility, reported by the loss-of-visibility alert.
The bridge has no IP address and cannot speak IP into the process network; forwarded traffic never touches the packet filters; no blocking rules on the data path, verified at every boot. On a software hang the sensor reboots itself (kernel.panic=10) and the bridge returns in about 2 minutes. On power loss or hardware failure the link is interrupted: this is why inline is used only in evaluations, with the client's written consent, or with a hardware-bypass network card.
Out of band only: own 4G modem and a dedicated encrypted tunnel to a server dedicated to the client. No open port in the client's network, no dependency on it.
Raw data stays on the sensor and on the dedicated server; at the end of the evaluation it is deleted with an evidence log within 5 working days of delivering the report.
| Ports | 1000/full, 0 errors |
| Packets dropped by the detection engine | 0 |
| Frames emitted by the sensor into the monitored network | 0 in 120 s |
| Recovery after a full reboot | 4 min 53 s, modem included |
| Bridge recovery after a software hang | about 2 minutes |
Latency added by the inline bridge and switch-over time on a production network will be published after the first client installation; we do not show estimated values.