This figure shows the before and after connection of a TAP. Before connection, the connected devices are Internet, firewall, router, firewall and switch. In the after part, the TAP is insert between the router and left-hand side (second) firewall. A call out from the connection from the TAP to the monitoring device reads "The passive Tap creates a permanent, in-line access port to monitor full-duplex traffic". A second call out reads: "The network signal is either split or regenerated so that the monitoring device has full access to the signal". A third call out, from between the TAP and firewall reads "The monitoring device sees the same traffic as if it were also in-line, including physical layer errors".