A network can be monitored using a technique called port mirroring. When port mirroring is enabled, each data packet that comes into or out of a specific switch port is copied and sent to a destination port. Once the copied packet reaches the destination port, it can be examined by a security application or monitored by software. Following implementation, mirroring can alert administrators to network problems and contribute to troubleshooting. Port mirroring and managing switch ports are set up by administrators or through a security application. To do this, they assign one port to copy the data, and a second one to receive and evaluate the mirrored data.
Using a Protocol Analyzer or Packet Sniffer
During the port mirroring process, a protocol analyser is key. The analyser is located on the port that receives the mirrored packets. This analyser may also be referred to as a network analyser or a packet sniffer because it routinely inspects and evaluates the data. An analyser can be a physical device or software that evaluates the packets. Port mirroring is a standard IT industry term. Manufacturers have other names for the technology, which they use in describing their networking product features. Vendor terms include Switched Port Analyser (SPAN) and Roving Analysis Port (RAP).
Network Monitoring Techniques
The technique of port mirroring can support network monitoring, facilitate component diagnostics, and potentially thwart network attacks. Port mirroring methods are used in LANs, VLANs and WLANs. After at least two ports are interconnected, data traffic may be transmitted to the analyser or to a monitor. Since data is forwarded to another port for analysis, the client on the first port is not impacted by the monitoring process.