Been searching but no clear understand. TDE encrypts at rest not in flight. But does in flight refer to only between server and client or also between server and SAN storage.
When a database uses TDE, does a page, when it is written to the disk, leave the buffer pool encrypted. So if somebody were to sniff the wire between the DB server and the SAN see only encrypted data. Or does it flow unencryted to the SAN and then is encrypted as its being saved. Same when is it decrypted, when it reaches the buffer pool or when it leaves the SAN? (note I understand when it goes to the client it is not encrypted)
This link was related to backups Is network traffic encrypted when writing remote backups using SQL Server TDE? Does it apply to data also?
Reference to docs would be great.