A system comprising: a headend system configured for managing network devices in a monitored network; an access point (114, 410) configured for managing communications between a subset of the network devices (160, 150) in the monitored network, the subset of the network devices comprising network nodes and a network tap device unknown to other network devices (160, 150) in the subset of the network devices except for a parent network device of the network tap device; and the network tap device in connection with the access point (114, 410) through the monitored network and managed by the access point (114, 410) and the headend system, the network tap device configured for: joining the monitored network as a network device of the monitored network, joining the monitored network comprising: communicating with the access point (114, 410) to obtain security keys of the monitored network, and communicating with the access point (114, 410) to obtain a network address for the network tap device; collecting network data for the monitored network, comprising: detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data; connecting to a monitoring workstation via a data transmission network different from the monitored network; and transmitting the collected network data to the monitoring workstation via the data transmission network. a headend system configured for managing network devices in a monitored network; an access point (114, 410) configured for managing communications between a subset of the network devices (160, 150) in the monitored network, the subset of the network devices comprising network nodes and a network tap device unknown to other network devices (160, 150) in the subset of the network devices except for a parent network device of the network tap device; and the network tap device in connection with the access point (114, 410) through the monitored network and managed by the access point (114, 410) and the headend system, the network tap device configured for: joining the monitored network as a network device of the monitored network, joining the monitored network comprising: communicating with the access point (114, 410) to obtain security keys of the monitored network, and communicating with the access point (114, 410) to obtain a network address for the network tap device; collecting network data for the monitored network, comprising: detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data; connecting to a monitoring workstation via a data transmission network different from the monitored network; and transmitting the collected network data to the monitoring workstation via the data transmission network. joining the monitored network as a network device of the monitored network, joining the monitored network comprising: communicating with the access point (114, 410) to obtain security keys of the monitored network, and communicating with the access point (114, 410) to obtain a network address for the network tap device; communicating with the access point (114, 410) to obtain security keys of the monitored network, and communicating with the access point (114, 410) to obtain a network address for the network tap device; collecting network data for the monitored network, comprising: detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data; detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data; connecting to a monitoring workstation via a data transmission network different from the monitored network; and transmitting the collected network data to the monitoring workstation via the data transmission network.