Port Mirroring

Port Mirroring is a feature of managed switches that copies network traffic from one or more ports to a designated monitoring port. Depending on the switch, VLANs or specific traffic directions can also be defined as sources. The original traffic continues to be forwarded normally. An analysis device or monitoring solution connected to the destination port can inspect the copied packets. Common use cases include network monitoring, packet capture, performance analysis, troubleshooting and security monitoring. Analysis tools such as Wireshark or Intrusion Detection Systems can examine mirrored traffic without being placed directly in the production data path. On Cisco network devices, a comparable function is commonly known as Switched Port Analyzer, or SPAN.