SPAN (Port Mirroring)

SPAN mirrors traffic from ports/VLANs to another port for analysis.

Updated: 2026-03-05

Definition

SPAN (Switched Port Analyzer) copies traffic from one or more ports/VLANs to a monitor port.

It’s used for troubleshooting, IDS sensors, and packet capture.

Key points

Mirrors traffic to a monitor port
Used for packet capture/IDS
Oversubscription can drop mirrored packets

Common mistakes

Assuming mirrored traffic is always complete (can drop under load).
Monitoring wrong direction (ingress/egress) or wrong VLAN.

Related exams

Cisco CCNA (200-301)

Free CCNA 200-301 mini test. Continue in the app for offline packs and detailed explanations.

CompTIA Network+ (N10-009)

Free Network+ N10-009 mini test. Continue in the app for offline packs and detailed explanations.

Related terms

Want to practice this in exam-style questions?

Use the mini tests on each exam page, then continue in the app for offline packs and detailed explanations.