In-line taps install between two network devices, usually a network switch and a server, two network switches or a switch and router. In the case of WAN links, the tap is installed between the router and the services provider. Monitoring devices are attached to the tap which provides a copy of the network traffic for real-time analysis.

In-line taps offer the clearest picture of a network links performance, including error, oversize, undersize, tagged and malformed packets. When measuring the timing of applications on a network link, in-line taps provide the most accurate representation of response time degradation, whereas SPAN ports can often skew the arrival time slightly. Two networks interfaces are required of the monitoring device attached to an in-line tap, in order to provide the full line rate performance that is necessary on high bandwidth networks. In-line taps are commonly used with protocol analyzers and network forensic solutions.