SPAN Port (Port Mirroring)
Definition
A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture device is connected. Implemented in software on the switch processor, so it can drop frames under high load and may not capture certain error frames that are filtered before the mirroring engine.
- Function
- Copies frames from source ports or VLANs to a destination port
- Implementation
- Software feature on the switch processor
- Load limitation
- Can drop frames under high load
- Capture gap
- May miss certain error frames filtered before mirroring
- Use
- Attaching a capture device for network traffic analysis
Common questions
Why can't a SPAN port be relied on for complete, forensically defensible packet capture?+
Because mirroring runs in the switch's software path and is deprioritised relative to forwarding traffic, frames can be silently dropped under heavy load, and certain malformed or error frames never reach the mirroring engine at all, so a SPAN capture can have gaps that a hardware network tap does not.
What is typically used instead of a SPAN port when capture integrity matters most?+
A dedicated network tap, a passive hardware device inserted inline on the link, copies every frame including errors without relying on switch CPU resources, and is generally preferred over SPAN ports for investigations where completeness of the capture must be defensible.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
- Ring Buffer Capture
- A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the...