What is Traffic Mirroring (SPAN)?

Traffic mirroring copies network traffic from one interface and forwards it to another – typically an out-of-band security or monitoring appliance – so the copy can be inspected without touching the original flow. On switches, this capability is commonly called switched port analyzer (SPAN); its GRE-encapsulated, routable variant is ERSPAN.

Key takeaways

• Traffic mirroring copies packets to a monitor port without disrupting the original flow.
• SPAN mirrors locally; ERSPAN wraps mirrored packets in GRE to reach a remote monitor.
• VOS supports NPU-based SPAN/ERSPAN and separate Layer 3 flow mirroring for forensics.
• Mirrored copies feed IDS/IPS, packet capture, and lawful-intercept tools out of band.
• Because inspection runs on a copy, mirroring adds no latency to production traffic.

On this page: Why it matters · How it works · Types · Traffic mirroring & Versa · FAQ

Why is traffic mirroring important?

Security and monitoring tools need to see network traffic without sitting in its path. An inline appliance – a firewall, an IDS sensor wired into the flow – adds latency, becomes a single point of failure, and can only inspect what passes through it. Traffic mirroring solves this by sending a copy instead: the original packets keep moving on their normal path, while the mirrored copy goes to an out-of-band appliance for inspection or troubleshooting.

Because the mirror is only a copy, a monitoring tool can be added, changed, or disabled without touching production traffic. That is also why mirroring underlies so much downstream tooling – deep packet inspection, intrusion detection, forensic captures, and lawful-intercept systems all depend on a faithful copy delivered out of band.

What is traffic mirroring?

Traffic mirroring matches traffic against a rule – by interface, direction, address, zone, application, or URL category – and forwards a copy of every matching packet to a mirror interface, while the original continues unmodified along its normal path. The mirror interface typically connects to a monitoring appliance.

Two mechanisms cover most implementations. Hardware-based mirroring operates at the switching layer: an NPU duplicates matching packets and forwards the copy to a local mirror interface, or encapsulates it in GRE to route it to a monitoring node anywhere on the IP network. Software-based flow mirroring works at Layer 3, matching packets by policy and forwarding them over a virtual interface or a GRE/IPsec tunnel – suited to forensics and analytics where the collector sits off-box.

Types of traffic mirroring

Three mechanisms cover most deployments. SPAN (switched port analyzer) is the original, local form: matching traffic on an interface is copied to a mirror interface on the same device – the simplest way to attach a monitoring appliance to a switch. ERSPAN (encapsulated remote SPAN) extends this across a routed network by wrapping mirrored Layer 2 packets in GRE and IP headers, so they can reach a station anywhere the destination IP is reachable. Layer 3 flow mirroring works differently: a policy service matches packets by address, zone, application, or URL category and forwards them over a virtual interface or a GRE/IPsec tunnel – suited to lawful interception, forensics, and analytics.

Traffic mirroring & Versa

VOS devices support both mechanisms. On appliances with NPU switching hardware, administrators configure SPAN and ERSPAN policies from Director view: rules match traffic by routing instance, bridge domain, interface, and direction, and each sets a local mirror interface or, for ERSPAN, a profile with a GRE-encapsulated destination IP reachable anywhere on the routed network. See Configure NPU Traffic Mirroring. Separately, VOS supports Layer 3 flow mirroring for lawful interception and analytics: a traffic-detection-function service mirrors packets matched by zone, address, application, or URL category, forwarding them over a virtual interface or a GRE/IPsec tunnel to a collection device.

Frequently asked questions

What is the difference between SPAN and ERSPAN?

SPAN mirrors traffic to an interface on the same device – simple, but limited to a locally attached appliance. ERSPAN wraps the mirrored packets in GRE and IP headers, so the copy can be routed to a monitoring station anywhere the destination IP is reachable.

Does traffic mirroring affect the original traffic?

No. Traffic mirroring copies matching packets; the originals continue along their normal path completely unmodified. If the destination link is congested, the mirrored copy itself can be dropped, but that never affects the production traffic being mirrored or its delivery.

What is the difference between SPAN and flow mirroring in VOS?

SPAN and ERSPAN operate at the NPU hardware-switching layer, copying packets by interface and direction. Flow mirroring instead works at Layer 3 through a traffic-detection-function service, matching packets by zone, address, application, or URL category before forwarding the copies on.

What kinds of tools does traffic mirroring feed?

Any out-of-band monitoring tool: intrusion detection sensors, deep packet inspection appliances, packet-capture and forensic tools, and lawful-intercept collectors all rely on it. Because the appliance receives only a copy, it inspects traffic without sitting inline or adding latency to the path.

Can traffic mirroring reach a device outside the local network?

Yes, using ERSPAN or Layer 3 flow mirroring. Both encapsulate the mirrored traffic – ERSPAN in GRE, flow mirroring over a GRE or IPsec tunnel – so the copy can reach any device reachable across the routed network, not just a local port.

More on traffic mirroring

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about traffic mirroring, these are worth looking at next.