A switch appliance includes a first network port for communication with a first node, where the first network port is configured to receive a packet, and a second network port for communication with a second node. The switch appliance further includes a first instrument port for communication with a first inline tool, a buffer, and a processing unit coupled to the first network port, the second network port, the first instrument port and the buffer. The processing unit is configured to determine whether a packet processing state has been set as an inline-tool processing state or a bypass state, and is configured to pass the packet to the second network port for transmission to the second node, and to store a copy of the packet in the buffer, if the packet processing state has not been set as the inline-tool processing state nor the bypass state.