The ForeScout CounterACT works much like a network sniffer looking for malicious sources.