Definition
Port mirroring, also known as Switched Port Analyzer (SPAN), is a network traffic analysis technique where a copy of traffic from one or more network ports is sent to a designated destination port. This process allows administrators to monitor network activity without interrupting the normal flow of data. It works by configuring a network switch to duplicate packets from specified source ports or VLANs and forward them to a monitoring port connected to a network analyzer or security device. Port mirroring is crucial for troubleshooting network issues, detecting security threats, and understanding network performance. For instance, a security analyst might use port mirroring to capture all traffic entering a web server to identify malicious activity. Unlike network taps which are hardware devices that physically intercept traffic, port mirroring is a software-based feature configured on the switch itself. This concept is frequently tested on CompTIA Security+, CySA+, and CISSP examinations.