The platform is connected to process mirrored traffic typically in case of using DPI as a pre-filter for SORM.

The analytics's and filtering options are also available in this case. The traffic transfer between interfaces in_dev and out_dev is not required in this mode. It can be switched off by configuration parameter:

tap_mode=1