US How port mirroring works
Port mirroring tells a managed switch to send a copy of selected traffic to a port of your choice, called the destination or monitor port. The original frames carry on to where they were going; the copies go to whatever is plugged into the monitor port, usually a laptop running Wireshark, a network monitoring probe or an intrusion detection sensor.
You choose three things: the source, which can be one port, several ports or a whole VLAN; the direction, meaning traffic received by the source (ingress), sent by it (egress) or both; and the destination port. On most switches the destination port stops acting as a normal port while mirroring is active, so nothing else should be connected to it.
Mirroring is needed because a switch, unlike an old hub, forwards each frame only to the port where its destination lives. A laptop plugged into a spare switch port sees almost none of the conversation between a PLC and its HMI. A mirror port puts that conversation in view without changing the cabling.
Types of port mirroring
Vendors use different names, but there are three broad kinds.
-
//
Local mirroring (SPAN). Source and destination ports are on the same switch. It is the simplest to set up and adds no load to the rest of the network. Switched Port Analyzer, or SPAN, is Cisco’s name, and many people use it generically.
-
//
Remote mirroring (RSPAN). The copies travel across trunk links on a dedicated VLAN to a monitor port on another switch, so one analyzer can watch several switches. Every switch on the way must carry the RSPAN VLAN.
-
//
Encapsulated remote mirroring (ERSPAN). The copies are wrapped in GRE and routed over IP, so the analyzer can sit in another subnet or site. The extra headers add bandwidth and processing.
-
//
VLAN-based mirroring. Mirrors all traffic in a VLAN instead of a list of ports. Useful for watching a whole production cell, as long as the monitor port can keep up.
TAP vs SPAN
A network TAP (test access point) is the main alternative. It is a small hardware device fitted inline on a cable, which copies every signal passing through it to monitor outputs. The choice between them is a common question, and the answer depends on what the capture is for.
| Feature | Port mirroring (SPAN) | Network TAP |
|---|---|---|
| Hardware | Built into a managed switch | Separate device inline on the cable |
| Installation | Configuration only, no outage | Cable must be broken to fit it |
| What it sees | Frames the switch forwards; errored frames usually dropped | Every frame on the wire, including errors |
| Under heavy load | Copies can be dropped if the monitor port is oversubscribed | Full-duplex copy at line rate |
| Timing | Switch processing can shift timestamps | Timing preserved, useful for latency work |
| Coverage | Many ports or a VLAN to one monitor port | One link per TAP |
| Effect of failure | Original traffic unaffected | Passive TAPs keep the link up; active TAPs need power |
In practice, mirroring suits troubleshooting and continuous monitoring of moderate traffic, and it costs nothing if the switches already support it. A TAP suits forensic capture, latency measurement and links that run close to full speed.
Port mirroring on industrial networks
Port mirroring has become a standard part of operational technology (OT) networks, for two reasons.
The first is troubleshooting. When a drive drops off an EtherNet/IP connection or a Modbus TCP poll times out, a capture from a mirror port shows exactly which device stopped answering and when. Wireshark decodes the common industrial protocols, so a mirrored capture is often the quickest way to settle where a fault lies.
The second is security monitoring. OT intrusion detection and asset discovery tools usually listen passively to a mirror feed instead of actively scanning, because active scans can upset older PLCs and controllers. Guidance such as NIST SP 800-82 describes network monitoring as part of defending industrial control systems, and placing mirror ports at the boundaries between cells and the plant core is a common way to give those sensors visibility. Our explainer on IT vs OT covers why the two networks are monitored differently.
Our managed industrial switches commonly list port mirroring alongside sFlow and RMON, and several of our rack mount industrial switches add RSPAN for monitoring across a control-room core. Board-level designs are covered too: several of our embedded Ethernet switches list port mirroring among their management features.
Limits of port mirroring
Mirroring is easy to switch on, but a few limits catch people out.
-
//
Oversubscription. Mirroring both directions of a full-duplex 1 Gb/s port can produce up to 2 Gb/s of copies, more than a 1 Gb/s monitor port can carry, so some copies are dropped without warning.
-
//
Lower priority. Many switches treat mirrored copies as low-priority work and drop them first when busy, which is fine for monitoring but not for evidence.
-
//
Errored frames. Frames with bad checksums are normally discarded before mirroring, so a physical-layer fault may not appear in the capture.
-
//
Session limits. Switches support a limited number of mirror sessions, often one or two, so plan which ports matter most.
-
//
Security. A mirror port exposes every mirrored conversation. Keep it disabled when not in use and restrict who can configure it.
Quick answers on port mirroring
Port mirroring: common questions
What is port mirroring used for?
Seeing traffic without interrupting it. Typical uses are troubleshooting with a packet analyzer, feeding intrusion detection and performance tools, and recording traffic for audits.
Is a SPAN port the same as port mirroring?
Yes, in practice. SPAN is Cisco’s name for port mirroring. Other vendors say mirror port, monitor port or analyzer port for the same feature.
What is the difference between port mirroring and port forwarding?
They are unrelated. Mirroring copies traffic on a switch for analysis. Port forwarding is a router or firewall rule that sends incoming connections on a TCP or UDP port to an internal host.
Does port mirroring slow the network down?
Usually not. Local mirroring uses the switch’s spare capacity. Remote mirroring adds traffic to trunk links, so size them for it.
Can you mirror a whole VLAN?
On most managed switches, yes. Check that the monitor port has enough bandwidth for everything in the VLAN, or mirror only the ports you need.
We supply managed industrial switches as part of a complete system, and as standard we can set up the VLANs and a documented mirror port for your monitoring tools before the system ships.