Hack the Route Start free Open app Switches and VLANs
Port mirroring (SPAN)
A switch copying every frame of some ports out of another port, where a sensor or capture box listens.
Port mirroring (SPAN, Switched Port Analyzer, on Cisco: monitor session 1 source interface … both,
monitor session 1 destination interface …) makes the switch send a copy of each frame in and/or out of the source
ports to a destination port, besides forwarding the original as usual. An IDS, a protocol analyser or a capture box
there sees conversations that are not addressed to it, without being on their path: it can neither slow nor break
them. A network TAP does the same in hardware on one cable. A busy source can send more than the destination port
carries, and the copies are then lost: a mirror is for watching, never for forwarding.