What Is SPAN? Security Definition

Imagine you are a librarian who needs to see every book being checked out from a busy library desk, but you cannot stand right there because you would get in the way. You could set up a mirror that reflects the checkout counter, but you need a way to see that reflection without disturbing the librarian. In a computer network, SPAN is exactly that mirror. It copies all the data packets coming and going on a particular switch port and sends that copy to another port where you have a monitoring computer or a recording device.

A network switch is like a smart post office inside a building. It knows which room each letter belongs to and delivers it only to that room. Normally, the switch does not let anyone else see those letters. But sometimes you need to check if there are problems or if someone is sending bad letters. SPAN lets you watch the letters without opening them or stopping delivery.

SPAN copies traffic from a source port (the one you want to watch) to a destination port (the one with your monitoring tool). This copy is a perfect duplicate of the original traffic, including all the headers and data. The original traffic continues undisturbed to its intended destination. The monitoring tool can be a packet analyzer like Wireshark, an intrusion detection system, or a network performance monitor. SPAN can also copy traffic from a VLAN instead of a single port, which is useful for watching an entire group of devices at once.

SPAN does its work entirely inside the switch hardware, so it does not slow down the network. The switch simply makes an extra copy of each packet as it passes through and sends that copy out the monitoring port. This is different from a hub, which sends all traffic to every port and slows everything down. SPAN is efficient and targeted.

SPAN, or Switch Port Analyzer, is a Cisco-proprietary feature originally developed for Catalyst switches, now widely implemented by many vendors under names like port mirroring, RSPAN (Remote SPAN), or monitor session. SPAN performs packet duplication at the hardware layer of a switch, allowing an administrator to capture ingress, egress, or both directions of traffic on one or more source interfaces and forward the copied frames to a destination interface for analysis by a network analyzer, intrusion detection system, or recording appliance.

SPAN operates at Layer 2 of the OSI model. When a switch receives a frame on a source port configured as a SPAN source, the switch's ASIC (Application-Specific Integrated Circuit) creates a copy of that frame in hardware before any switching decisions are made. The copy is then encapsulated or forwarded directly to the SPAN destination port. The original frame continues through the normal switching process without modification or delay. This process is non-intrusive and does not affect the performance of the source ports, though the monitoring port can become oversubscribed if the aggregate traffic exceeds its line rate.

There are several types of SPAN sessions. Local SPAN copies traffic to a destination port on the same switch. Remote SPAN (RSPAN) extends monitoring across multiple switches using a dedicated RSPAN VLAN to carry mirrored traffic between switches. Encapsulated Remote SPAN (ERSPAN) uses Generic Routing Encapsulation (GRE) to transport mirrored traffic over a routed IP network, enabling monitoring across Layer 3 boundaries. Each type has specific configuration requirements and limitations. For example, RSPAN requires all intermediate switches to support the RSPAN VLAN, and ERSPAN adds IP header overhead, which can affect the maximum frame size.

Common configuration parameters for SPAN include source interfaces (individual ports, port channels, or VLANs), direction (ingress only, egress only, or both), destination interface (a single port or a port channel), and encapsulation options (whether to preserve original VLAN tags). Some switches also support features like SPAN filtering, which restricts which packets are mirrored based on access control lists or VLAN membership, reducing the load on the monitoring tool. SPAN sessions can be configured via CLI, SNMP, or network management platforms, and they typically support multiple simultaneous sessions, though the exact number depends on the switch model and ASIC capabilities.

Limitations of SPAN include the potential for packet dropping on the destination port if the mirrored traffic exceeds the port's bandwidth. Also, SPAN does not copy control plane traffic generated by the switch itself, such as STP BPDUs or CDP frames, unless specifically configured. In some implementations, SPAN cannot mirror traffic from certain ports like uplinks or management ports. Understanding these constraints is critical for accurate traffic analysis and exam questions that test troubleshooting of monitoring setups.

SPAN is an essential tool for network troubleshooting, security monitoring, and performance analysis. Without SPAN, administrators would have to use hubs or inline taps to capture traffic, both of which introduce disruption or additional points of failure. A hub forces all ports to share the same collision domain, reducing performance and causing collisions. An inline tap must be physically inserted between devices, requiring downtime and potential misconfiguration. SPAN solves these problems by using the switch's existing hardware to create a non-disruptive copy of traffic.

In practice, SPAN is used to connect intrusion detection systems (IDS) that analyze traffic for malicious patterns without placing the IDS inline, which could slow down or block legitimate traffic if the IDS fails. SPAN also feeds network performance monitors that measure latency, packet loss, and jitter between endpoints. For troubleshooting, when a user reports slow application response, an administrator can set up a SPAN session on the user's switch port, capture the traffic with Wireshark, and analyze the handshake timings, retransmissions, and application-layer delays.

SPAN also supports compliance requirements. In sectors like finance and healthcare, regulations may require recording all network communications relevant to transactions or patient data. SPAN provides a reliable method to capture that data for archival purposes. SPAN is used in forensic investigations after a security incident. Administrators can replay captured traffic to understand the attack vector, lateral movement, and data exfiltration attempts.

One practical limitation administrators must manage is the oversubscription of the destination port. If a source port is operating at 1 Gbps and the destination port is 1 Gbps, and you mirror two 1 Gbps source ports, the destination port can only carry 1 Gbps total, causing packet drops. This matters because dropped packets mean incomplete analysis. Understanding this limitation is part of designing a monitoring network properly, often by using dedicated monitor ports or port channels for high-volume captures.

Questions about SPAN in certification exams typically fall into three patterns: scenario-based, configuration, and troubleshooting. In scenario-based questions, you are given a situation where a network administrator needs to capture traffic to diagnose a problem or connect a security appliance. You must recommend the correct method. For example: An administrator is troubleshooting slow application performance for users in the Sales VLAN. Which configuration should be implemented? The correct answer is to configure a SPAN session that mirrors the Sales VLAN to a destination port connected to a packet analyzer.

Configuration questions provide a partial switch configuration or CLI output and ask about its effect. For instance: Switch(config)# monitor session 1 source interface GigabitEthernet0/1 both Switch(config)# monitor session 1 destination interface GigabitEthernet0/20 What traffic will be seen on interface Gi0/20? The answer is both incoming and outgoing traffic on Gi0/1. A more advanced question might include SPAN filtering: monitor session 1 filter access-list MYLIST. You would need to know that only packets matching the ACL will be copied.

Troubleshooting questions present a problem where the monitoring tool is not seeing traffic. A common cause is that the destination port is still configured as an access port in a VLAN, so the monitoring device cannot receive the mirrored packets because the switch drops them. Another cause is that the source interface is a trunk port and the SPAN session is not configured to preserve VLAN tags. You may be asked to identify the misconfiguration. For example: An engineer configures a SPAN session but notices that the monitoring workstation receives no packets. What is the most likely cause? The answer could be that the destination port is in the wrong VLAN or that the SPAN session is in shutdown state.

Exam questions also compare SPAN with other capture methods. You might see: Which of the following provides complete packet-level visibility without injecting into the data path? Options: NetFlow, SPAN, SNMP, syslog. SPAN is correct because it copies packets without affecting the original flow. Also, questions on RSPAN and ERSPAN test your understanding of their respective use cases, such as sending mirrored traffic across a routed network (ERSPAN) vs. a Layer 2 network (RSPAN).

SPAN is one of the most used features for network troubleshooting, but professionals must understand its limitations to avoid incomplete or misleading captures. The biggest practical issue is destination port oversubscription. If you mirror a 1 Gbps full-duplex port, the actual traffic in both directions can be up to 2 Gbps (1 Gbps inbound and 1 Gbps outbound). If your destination port is only 1 Gbps, you will drop half the traffic under full load. Always try to use a higher-speed destination port or limit the number of source ports. You can also use SPAN filtering to capture only specific protocols, reducing the load.

Another practical consideration is that SPAN copies packets after the switch has already processed them. This means that any packets that are dropped due to errors or ACLs on the source port are not mirrored. The monitor sees only the traffic that was successfully forwarded. Also, SPAN does not copy frames that are switched entirely in hardware if the frame is destined for a port on a different ASIC, but modern switches handle this transparently. However, it is worth knowing that the exact behavior can vary between switch models.

When configuring SPAN in a production environment, always perform the configuration during a maintenance window or on a test port first. Misconfiguring a SPAN session can accidentally shut down the source port or cause a loop if the destination port is incorrectly set. Some switches automatically disable the source port if the destination port fails, so ensure your monitoring device is always powered on.

For advanced use, professionals employ RSPAN to centralize monitoring across multiple switches. Setting up RSPAN requires creating a dedicated RSPAN VLAN on all switches involved, then configuring source sessions on each access switch that sends mirrored traffic into the RSPAN VLAN, and a destination session on the core switch that copies the RSPAN VLAN to a local monitor port. ERSPAN is even more flexible but requires more overhead and is only available on higher-end switches or routers.

Finally, always verify your SPAN configuration with packet captures. If your monitoring device sees duplicate frames, check whether you are mirroring both directions and your analyzer is interpreting them correctly. Duplicate frames can be normal in some troubleshooting scenarios, but they can also indicate a misconfiguration. Knowing how to interpret what you see on the wire is the true skill that turns SPAN from a simple tool into a powerful diagnostic instrument.