It was through the use of a ProfiShark 1G network TAP, that I was able to confirm that a rootkit was indeed on the system and it was obfuscating the network socket that was being used for malicious communications. The packets never lie and they showed that there was malicious activity being masked, when a one-to-one comparison was conducted between the captured traffic from a TAP (external to the host’s NIC) and the host system’s built-in network tools. When a scenario like this occurs and you can no longer trust the host operating system, you have to leverage a trusted third-party tool to interrogate the infected system.

ProfiTaps 10G Bypass TAP Datasheet

The main differences between a network TAP and a SPAN