In this environment, say a user attaches their own rogue access point and beings using unauthorized wireless hosts with it.
To quickly detect such unauthorized activity in realtime, the incoming and outgoing traffic from a central gateway is passively monitored.