Methods and apparatus for providing out-of-band network traffic monitoring such as intrusion detection to clients on a provider network. A client can configure new or existing components and specify that traffic monitoring be added on or at the components in the client's configuration on the provider network. Traffic monitoring is provided for the client's configuration via replication technology on the provider network. In response to the client specifying that traffic monitoring is to be added on or at a component, traffic to the client's configuration is routed to replication technology, which may be implemented at a network substrate level, that passes one copy to the client's configuration and sends another copy to a destination that handles traffic monitoring such as an intrusion detection handler. The destination may be anywhere on the provider network or on an external network.