when monitoring a network, and faced with choices of where to tap the network, a tap which captures a wider view can be advantageous. For instance, capturing at a WAN link can provide a better view of attackers.