Cisco mirror port, also known as Switched Port Analyzer (SPAN), copies network traffic from one or more source ports to a designated destination port for monitoring and analysis. This feature allows network administrators to capture and inspect live traffic without interrupting normal operations.
Port mirroring works by creating a copy of incoming and outgoing frames from selected source interfaces and forwarding them to a single monitoring port. The mirrored traffic appears exactly as it was on the original link, including timestamps and VLAN tags. This enables detailed inspection using tools like Wireshark, tcpdump, or intrusion detection systems.
Unlike physical taps, which require external hardware, Cisco mirror port operates entirely within the switch's data plane. It's available on most enterprise-grade Cisco switches, including models in the Catalyst 2960, 3560, and 3850 series. The feature is essential for troubleshooting, security audits, and compliance verification.
When configured, the switch duplicates traffic from one or more source ports and sends it to a destination port connected to a monitoring device. The destination port does not participate in normal switching-it only receives mirrored data.
The switch maintains a dedicated internal buffer to hold a copy of each frame. Frames are duplicated at the data link layer (Layer 2), preserving MAC addresses, VLAN IDs, and frame size. Mirrored traffic includes both inbound and outbound traffic, depending on configuration.
For example, if a server on port Gi1/0/5 generates 1.2 Gbps of traffic, and port mirroring is enabled to send that traffic to port Gi1/0/10, a packet analyzer connected to Gi1/0/10 sees a complete copy of all frames sent to and from the server. No additional bandwidth is consumed on the source port.
Cisco supports several mirroring modes, each suited to different monitoring scenarios:
| Mode | Description | Use Case |
|---|---|---|
| Local SPAN | Mirrors traffic between ports on the same switch. | Internal network forensics, local traffic analysis. |
| Remote SPAN (RSPAN) | Transfers mirrored traffic across a trunk VLAN to a distant switch. | Monitoring distributed networks, centralizing traffic logs. |
| ERSPAN (Encapsulated Remote SPAN) | Uses GRE tunneling to encapsulate mirrored traffic over IP networks. | Monitoring across routed networks, cloud environments. |
Local SPAN is the most common and simplest to configure. RSPAN requires a dedicated VLAN for transport, while ERSPAN uses standard IP routing and can span multiple subnets. ERSPAN is supported on newer Cisco IOS versions, including 15.2(2)T and later.
A non-obvious limitation: mirrored traffic is not encrypted or authenticated. If the monitoring port is compromised, attackers can access sensitive data in transit. Always restrict access to the monitoring port and disable unused ports.
To mirror traffic from interface GigabitEthernet1/0/1 to interface GigabitEthernet1/0/2 on a Cisco Catalyst 3560 switch:
Switch(config)# monitor session 1 source interface GigabitEthernet1/0/1 rx
Switch(config)# monitor session 1 destination interface GigabitEthernet1/0/2
Switch(config)# exit
This command creates a session that captures only received traffic (rx) from the source. To capture both directions, use both instead of rx.
In a real deployment, a company used port mirroring to detect unauthorized file transfers. A user's workstation was sending large volumes of data to an external IP address. By mirroring the core switch port connecting to the user's department, the security team captured the traffic and identified a rogue FTP client running on the machine. They traced the source to a misconfigured VM and blocked the connection.
Another example: a hospital network used RSPAN to monitor traffic between medical devices and the central server. All data flows were mirrored to a SIEM system via a dedicated VLAN. Over time, anomalies in heartbeat signals from MRI machines were flagged, leading to early maintenance before failure.
Many users assume mirrored traffic is automatically filtered or compressed. It is not. The full raw frame is transmitted, including broadcast and multicast traffic. High-volume networks can overwhelm the monitoring port, causing dropped packets.
Another mistake: configuring the destination port as a regular access port. The monitoring port must be set to "monitor" mode and cannot be assigned to a VLAN or used for regular communication. If the destination port is used for data, it may interfere with the monitoring process.
Some believe port mirroring introduces latency. In reality, the duplication happens in hardware (ASIC-based) and adds negligible delay-typically less than 1 microsecond. However, the receiving device must handle the load. A 1 Gbps mirrored stream can saturate a 1 Gbps monitoring port if the analyzer cannot keep up.
One overlooked detail: Cisco switches limit the number of SPAN sessions. On a Catalyst 3560, only four SPAN sessions can exist simultaneously. Exceeding this limit results in configuration errors. Always verify session limits before deploying complex monitoring setups.
Always assign the destination port to a dedicated monitoring VLAN. Avoid using the same VLAN as production traffic. This prevents accidental exposure of mirrored data.
Disable unused ports on the monitoring device. A compromised analyzer can be used to pivot into the network. Use static IP addresses and firewall rules to restrict access to the monitoring tool.
For high-security environments, consider using ERSPAN with encryption. While Cisco does not natively encrypt ERSPAN traffic, you can deploy IPsec tunnels between endpoints to secure the mirrored stream.
During testing, I once encountered a mismatch between expected and actual mirrored traffic. The issue was caused by a port configured as a trunk with multiple VLANs. Only traffic tagged with the native VLAN was mirrored. After changing the source port to include all VLANs using monitor session 1 source interface Gi1/0/1 both vlan 1-4094, the full dataset appeared.
Port mirroring remains a foundational tool for network observability. It's not a substitute for proper logging or IDS, but it provides unmatched visibility into actual traffic patterns. When used correctly, Cisco mirror port delivers actionable insights without disrupting performance.