Port mirroring is used on a
network switch
A network switch (also called switching hub, bridging hub, and, by the IEEE, MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device.
A netw ...
to send a copy of
network
Network, networking and networked may refer to:
Science and technology
* Network theory, the study of graphs as a representation of relations between discrete objects
* Network science, an academic field that studies complex networks
Mathematics ...
packets seen on one switch
port
A port is a maritime facility comprising one or more wharves or loading areas, where ships load and discharge cargo and passengers. Although usually situated on a sea coast or estuary, ports can also be found far inland, such as H ...
(or an entire
VLAN
A virtual local area network (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at the data link layer ( OSI layer 2).IEEE 802.1Q-2011, ''1.4 VLAN aims and benefits'' In this context, virtual, refers to a ph ...
) to a
network monitoring
Network monitoring is the use of a system that constantly monitors a computer network for slow or failing components and that notifies the network administrator (via email, SMS or other alarms) in case of outages or other trouble. Network monitori ...
connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic such as an
intrusion detection system
An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically rep ...
,
passive probe or
real user monitoring
Real user monitoring (RUM) is a passive monitoring technology that records all user interaction with a website or client interacting with a server or cloud-based application. Monitoring actual user interaction with a website or an application is i ...
(RUM) technology that is used to support
application performance management
In the fields of information technology and systems management, application performance management (APM) is the monitoring and management of the performance and availability of software applications. APM strives to detect and diagnose complex appl ...
(APM). Port mirroring on a
Cisco Systems
Cisco Systems, Inc., commonly known as Cisco, is an American-based multinational digital communications technology conglomerate corporation headquartered in San Jose, California. Cisco develops, manufactures, and sells networking hardware, ...
switch is generally referred to as ''Switched Port Analyzer'' (SPAN) or ''Remote Switched Port Analyzer'' (RSPAN). Other vendors have different names for it, such as ''Roving Analysis Port'' (RAP) on
3Com
3Com Corporation was an American digital electronics manufacturer best known for its computer network products. The company was co-founded in 1979 by Robert Metcalfe, Howard Charney and others. Bill Krause joined as President in 1981. Metcalfe e ...
switches.
Network engineers or administrators use port mirroring to analyze and
debug data or diagnose errors on a network. It helps administrators keep a close eye on network performance and alerts them when problems occur. It can be used to mirror either inbound or outbound traffic (or both) on single or multiple
interfaces.
See also
*
VLAN access control list (VACL)
External links
Cisco Systems - Catalyst Switched Port Analyzer (SPAN) Configuration ExamplePort mirroring (roving analysis port)- TechTarget, 2014
Port Mirroring- Technopedia
Computer network analysis
{{Networking-stub