Figure 5 shows the setup of a passive

 Figure 5 shows the setup of a passive
monitoring system where the monitor is placed on a single link between two endpoints and monitors traffic as it passes along the
link.
Figure 5: Passive Monitoring Setup
Passive measurements deal with information such as: Traffic and protocol mixes Accurate bit or packet rates Packet timing and
inter-arrival timing
Passive monitoring can be achieved with the assistance of any packet sniffing program.
Although passive monitoring does not have the overhead that active monitoring has, it has its own set of downfalls. [UnivPenn02]
With passive monitoring, measurements can only be analyzed off-line and not as they are collected. This creates another problem
with processing the huge data sets that are collected.
As one can see passive monitoring my be better than active monitoring in that overhead data is not added into the network but
post-processing time can take a large amount of time. This is why a combination of the two monitoring methods seems to be the
route to go.