SPAN port (port mirroring)
Definition
A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture device is connected. Implemented in software on the switch processor, so it can drop frames under high load and may not capture certain error frames that are filtered before the mirroring engine.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Network tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- Promiscuous mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
- Ring buffer capture
- A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the...
Explained in
- Packet Capture Tools and MethodsA switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture device is connected. Implemented i...