Switched port analyzer (SPAN) ports provide similar functionality, but occur at the switch and do not require additional hardware. The network administrator simply configures one port on the switch to serve as a SPAN port, and the switch then delivers copies of all traffic from any port on the switch to the SPAN port, allowing for the connection of a monitoring device. From a security perspective, there's not much difference between a TAP and a SPAN port. Both are useful for monitoring network traffic (albeit at different points in the network) and provide the same basic functionality.
- Lock down IM by monitoring traffic over the network.
- Is it possible to monitor and block port-scanning activity? Learn more.
This was first published in April 2008