An inline network device sits in the traffic path and can inspect or act on packets as they pass through it in real time.
If the device stops forwarding, the path stops, which is the operational fact that separates it from a passive copy of the traffic.
How it works
Firewalls, prevention systems, and some load balancers are inline when packets must cross them to reach the next hop.
A tap or a mirror port can feed a detector without sitting in the path, so that detector can fail without taking the business offline.
Inline placement is powerful because the device can drop, rewrite, or rate limit before the packet arrives, and it is risky because the device becomes a single point of failure.
Designers therefore plan bypass, high availability pairs, or a deliberate fail open or fail closed choice that matches the risk.
Concrete examples
- A branch firewall forwards every office packet and the branch loses internet when that firewall loses power.
- An intrusion prevention appliance sits between the data center core and the server row so it can drop a matching session.
- A mail gateway receives messages, scans them, and relays the accepted ones, which means mail queues when the gateway is down.
Protective measures
- Decide in advance whether each inline device should fail open or fail closed, and test that behavior.
- Monitor the device health as closely as the service it protects, because its outage is a service outage.
- Keep a documented bypass for maintenance so a firmware change does not become an unplanned blackout.
- Do not assume a passive sensor has the same blocking power as a device that packets must cross.