Hi Plawansai,

I saw your question that is still unanswered.

I believe an advantage of using a passive monitoring technique is that it won't interfer with live traffic, as it does not inject traffic into the network or modify the traffic that is already on the network.

One drawback anyway, is that post-processing time can take a large amount of time with passive monitoring!
A combination of the two monitoring methods seems to be the route to go.

V.