Most network cards are designed on an unstated assumption: if the computer dies, the link dying with it is acceptable. For an endpoint, that is true. For an inline appliance — a firewall, an intrusion-prevention system, a traffic auditor that sits physically in the middle of a production link — it is the opposite of acceptable. The appliance is a guest in someone else’s traffic path, and its first duty is to never become the outage. The bypass NIC is the hardware that discharges that duty. GRT builds bypass adapters at two rates — the F1102EBPLR at 100G optical and the FF-902TBP at gigabit copper — and this article explains the mechanism both share.
Three modes, one promise
A bypass adapter presents a pair of ports wired into the link. In Normal mode, traffic passes through the host: frames arrive on one port, the appliance inspects them, and they leave on the other. In Bypass mode, the card connects its two ports to each other internally, and traffic flows past the host entirely — the appliance is electrically out of the path. In Disconnect mode, the card opens the link, for designs that would rather fail closed. The modes are software-programmable, because the right failure behaviour is a policy decision: most availability-first designs fail open (bypass), some compliance-first designs fail closed (disconnect).
The watchdog: deciding without the host
Mode switching is only useful if something trustworthy decides when to switch. That something is an on-board watchdog timer (WDT). The host software must periodically service ("pet") the watchdog; if the timer expires unserviced — because the OS hung, the application deadlocked, or a driver crashed — the card concludes the host is no longer competent and switches the link to bypass by itself. On our bypass models the timeout is programmable from 100 ms to 3,276.8 s, a range that spans "fail over almost immediately" to "tolerate long maintenance reboots without flapping the link". The watchdog is the moral centre of the product: an independent, stupid, incorruptible supervisor whose only job is noticing silence.
The power-off case
The hardest failure is the total one: the appliance loses power. Software cannot help; the watchdog cannot help. Bypass cards handle it in the physical layer — the port pair is arranged so that the unpowered state of the card is the bypass state. The link survives the appliance’s death because, electrically, the card’s resting position connects the link through. This is the property to interrogate when comparing bypass products: ask not what the card does when the software fails, but what it does when the PSU does.
When do you actually need one?
- Inline security enforcement (IPS, next-generation firewall) on links whose downtime is not an option
- Network monitoring and auditing taps that must be failure-transparent
- Industrial and control networks where a maintenance window on the appliance cannot stop the process
- Any appliance deployed in a path it does not own — carrier, campus backbone, data-centre perimeter
Conversely, if your appliance is an endpoint, or sits behind a tap/SPAN feed rather than in-path, a bypass card buys you nothing: mirroring architectures already isolate the observer from the path. The honest test is topological — draw the link, remove the appliance’s power in your imagination, and ask whether traffic should still flow. If yes, you need bypass hardware.
Virtualisation does not change the answer
Modern appliances are virtualised, and one bypass pair often serves several virtual security functions. That is why the 100G model supports flexible I/O virtualisation with up to 256 virtual channels and the gigabit model up to 16: the bypass decision stays in hardware below the hypervisor, while the inspection functions multiply above it. However many software layers you stack on the host, the watchdog still watches the one thing that matters — whether the host, as a whole, is alive and servicing it.
Does bypass mode reduce link speed?
No. Bypass is a physical path through the card; the link runs at line rate with the appliance out of the path.
Bypass or tap — which architecture is better?
They solve different problems. Taps/SPAN observe a copy and suit monitoring; bypass suits enforcement that must also fail safely. Many networks use both.
Can bypass behaviour be tested before production?
Yes — and it should be. Pull the host’s power in the lab and watch the link. Our loaner testing service exists for exactly this class of validation.
Specifying a bypass card: the questions that matter
- Media and rate of the protected link: copper gigabit and optical 100G are different products answering the same doctrine.
- Fail-open or fail-closed policy: which mode is your organisation’s failure religion — availability or containment?
- Watchdog range: does the programmable timeout span your appliance’s longest legitimate silence (patching reboots included)?
- Virtualisation: how many virtual functions must share the pair, and does the card’s channel count cover the design?
- Power behaviour: is the unpowered state bypass, verified by test rather than by brochure?
Notice what is not on the list: throughput marketing. A bypass pair runs at the link’s rate or it is not a bypass card at all. The differentiators are failure behaviour and supervision quality — the properties you cannot retrofit. That is also why evaluation units matter more for this product class than for any other in the catalogue: an afternoon of pulling plugs in the lab teaches more than a month of datasheet correspondence.
Bypass beyond security: monitoring and migration
The doctrine outgrew its first use. Network monitoring teams adopted bypass pairs because a probe that can take down the link it observes will eventually do so during the incident it exists to explain. Migration teams use the same hardware in reverse: a new platform is inserted in bypass, shadows the old one’s decisions, and is promoted to Normal mode only when its behaviour has earned the link — the safest cutover pattern ever devised for inline systems, because retreat is a mode switch, not a recabling. And in industrial networks, bypass pairs guard links whose traffic is physical process: there, the requirement is written not by IT policy but by the cost of a stopped line, and the watchdog’s silent supervision is valued accordingly. Anywhere a computer sits inside someone else’s critical path, the bypass question follows it there.
One sentence to carry away: a bypass NIC is not a faster or smarter network card — it is a network card that has rehearsed its own failure, and engaged engineers buy exactly that rehearsal. Specify the failure modes, test them before production, and the inline architecture the business needs stops being the outage the business fears.