Port Mirroring
Port mirroring = copying traffic passing through one or more switch ports (mirrored/monitored ports) to another port (mirror/monitor port) where an analysis tool is connected.
This lets you analyze live network traffic without disrupting normal operation and without bothering the endpoints.
What to copy to the mirror port: - Only ingress (rx) traffic - Only egress (tx) traffic - Both directions
Applications
- Troubleshooting
- Performance monitoring
- Security analysis
- Compliance auditing
- Eavesdropping (in an authorized context)
SPAN vs RSPAN vs TAP
| Technique | Scope | Note |
|---|---|---|
| SPAN | 1 switch | Source and mirror port on the same switch |
| RSPAN | Multiple switches | Requires a separate RSPAN VLAN + trunking |
| TAP | 1 connection | Hardware tap — no impact on switch performance |
SPAN = Switched Port Analyzer (Cisco term). Other vendors use their own names (port monitoring, ...) but the concept is identical.
Monitoring Sessions
Always work through monitoring sessions:
- Each session has one or more source ports/VLANs and one or more destination ports
- Port and VLAN mirroring cannot be combined in the same session
- Each destination port must be unique per session
- A destination port cannot itself be mirrored
- A destination port is no longer a normal switch port — only mirrored traffic passes over it
Destination Port Limitations
- Can only be a destination in 1 monitoring session
- An EtherChannel port or a secure port cannot be a destination port
Source Port
- Can be of any type (physical port, EtherChannel, access, trunk, voice VLAN, ...)
- Can appear in multiple monitoring sessions
Default Behavior
By default, only endpoint traffic is mirrored. Switch-to-switch traffic (STP, BPDU, CDP, VTP, LACP/PAgP) is skipped. To copy that too: use the encapsulation replicate option.
On trunk ports, traffic from all VLANs is copied by default — this can be restricted to a single specific VLAN.
SPAN Configuration
1. configure terminal
2. no monitor session {session_number | all | local | remote}
3. monitor session session_number source {interface interface-id | vlan vlan-id} [,|-] [both | rx | tx]
4. monitor session session_number destination {interface interface-id [,|-] [encapsulation replicate]}
5. end
Step 2 removes any existing sessions (all = SPAN + RSPAN, local = SPAN only, remote = RSPAN only).
Direction:
- both — ingress + egress (default)
- rx — received traffic only
- tx — transmitted traffic only
RSPAN Configuration
Requires the RSPAN VLAN to exist on all switches involved before you start.
Source Switch
1. configure terminal
2. no monitor session {session_number | all | local | remote}
3. monitor session session_number source {interface interface-id | vlan vlan-id} [,|-] [both | rx | tx]
4. monitor session session_number destination remote vlan vlan-id
5. end
Destination Switch
1. configure terminal
2. vlan vlan-id
3. remote-span
4. exit
5. no monitor session {session_number | all | local | remote}
6. monitor session session_number source remote vlan vlan-id
7. monitor session session_number destination interface interface-id
8. end
TAP — Test Access Point
SPAN and RSPAN consume resources on the switch itself and can slow down the switches involved.
A TAP (Test Access Point) is separate hardware placed inline on a network connection that copies the physical bits — no load on the switch, works at Layer 1. Downside: separate hardware is needed per monitored connection.