Nac Monitor
To set up a nac monitor, you turn on passive logging on your network switches. This nac monitor mode watches device logins and records access events without blocking traffic. Teams often use this mode first when they roll out new network rules. It lets admins see which laptops, phones, or servers fail checks before enforcement starts. If network roles are too broad, a trusted device can reach every internal server. How a nac monitor works on your network A network access control system checks
Monitor: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To set up a nac monitor, you turn on passive logging on your network switches. This nac monitor mode watches device logins and records access events without blocking traffic. Teams often use this mode first when they roll out new network rules. It lets admins see which laptops, phones, or servers fail checks before enforcement starts. If network roles are too broad, a trusted device can reach every internal server.
How a nac monitor works on your network
A network access control system checks devices before they join your local network. When you run it in monitor mode, the switch still asks for device identity. The switch sends the device details to a central policy server for a check. The server checks the device certificate, MAC address, or user login against your rules.
In full enforcement mode, a failed check drops the port or moves the VLAN. In monitor mode, the switch lets the device onto the network even if it fails. At the same time, the server writes a detailed log entry about the failure. Network admins read these logs to find broken certificates or missing agents on laptops. They also spot printers, badge readers, and shop devices that lack standard login tools. Once the logs show clean passes for known devices, the team turns on blocking.
What network monitoring solves and what it misses
Running a network check solves the problem of rogue devices plugging into wall ports. It helps your team map every machine on the wire and verify device health. Monitor mode also stops accidental outages while you tune your network rules and roles.
Still, a network check only looks at the device when it joins the network. Once the port opens, the switch does not read the commands sent inside encrypted sessions. A user on an approved laptop can still run dangerous database queries or delete tables. Network rules decide which machine gets an IP address on a specific subnet. They do not decide what individual queries, commands, or requests do in flight. Also, shared database accounts look identical at the network level, hiding who ran which query. If a query returns customer emails or card numbers, the switch will not mask them.
Monitor: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Moving from passive port checks to active session controls
After your team finishes testing port rules, you should look at higher layers. Network segments group systems together, but engineers still need to run tasks on production hosts. Giving an entire subnet open paths to databases leaves data exposed to bad commands. Teams get better safety when they pair device checks with strict controls on every command. You want to see the exact user identity tied to every database statement or script. You also want to rewrite sensitive fields like phone numbers and national IDs in results.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the difference between monitor mode and enforcement mode?
Monitor mode logs policy failures on switch ports while letting all network traffic pass through. Enforcement mode blocks unknown devices or places them into a restricted quarantine network right away.
How long should a team run in monitor mode?
Most teams run monitor mode for a few weeks to catch all active devices. This gives you time to fix laptop settings and register printers before turning on blocks.
Does network access control inspect database queries or shell commands?
No, network access control only checks the device and user when joining the local network. It cannot read, approve, or mask the data inside encrypted database or shell traffic.