How does a network TAP differ from a SPAN port as a packet source, and what happens to the monitored link when each loses power?
answer
- configuration versus hardware in the cable
- copy the frame or copy the signal
- a splitter needs no power
- copper gigabit must be regenerated
- one output per direction
basics
~20 sA SPAN port is switch configuration copying frames best effort; a TAP sits in the cable and copies the signal. A passive optical TAP needs no power, so a power cut is harmless; an active copper TAP typically drops the link briefly.
solid answer
~50 sA **SPAN port** (port mirroring; SPAN is one vendor's term) is configuration: the switch's own hardware duplicates frames and sends them out of a destination port - no outage to set up, but copies are best effort, damaged frames are typically not copied, and both directions merge onto one port. A **TAP** is a device inserted into the link. On fibre it can be **passive** - an optical splitter per fibre - so it needs no power and a power cut changes nothing, but it costs optical budget. Gigabit copper (IEEE 802.3's 1000BASE-T) carries both directions on the same pairs at once, so a copper TAP must be **active** and regenerate the signal; when its power fails, a relay typically joins the two sides and the link drops briefly while it renegotiates. TAPs copy everything on the wire, need a link break to insert, and give one output per direction unless they aggregate.
go deeper
Recall that SPAN is a switch configuration that copies frames, while a TAP is a device in the cable that copies the signal itself.
Explain passive optical splitting versus active copper regeneration, why a power cut is harmless to one and a brief outage for the other, and breakout versus aggregating outputs.
Show the operational judgment: optical budget after insertion, the outage needed to install, and why an aggregating TAP reintroduces the oversubscription a TAP was bought to avoid.
Treat visibility as an investment: decide which links justify permanent TAPs and monitor ports, and which can live with best-effort mirrors and their documented blind spots.
## Two ways to get a copy A **SPAN port** is a configuration on the switch: the switch's forwarding hardware duplicates frames and sends the duplicates out of a destination port. (Port mirroring is the generic name; SPAN is one vendor's term that the industry adopted.) A **network TAP** (test access point) is a separate device inserted into the cable between two devices; it copies the signal on the link and presents the copy on monitor outputs. Neither has an IETF or IEEE specification of the mirroring behaviour itself, so what follows is how the two designs typically behave rather than a standard's rule. ## Passive optical TAPs On fibre, a TAP can be entirely **passive**: an optical splitter in each fibre sends a fixed share of the light to a monitor output and the rest onward to the far end. - It needs **no power**, so a power cut changes nothing about the monitored link. - It costs **optical budget**: the far receiver now gets less light, so a link that was close to its margin can start taking errors after insertion. The split ratio is a product choice; check the link's budget before inserting one. - It copies the light, so whatever crossed the fibre - good frames, damaged frames, control frames - appears at the monitor output. - Each fibre carries one direction, so a passive TAP has **two monitor outputs**, one per direction. ## Active copper TAPs Gigabit copper is different. IEEE 802.3's 1000BASE-T sends both directions over the same four pairs at the same time, so the signal on the wire cannot simply be split and read. The TAP has to terminate the link on each side and **regenerate** it towards the other, which needs power. - When power fails, the typical design closes a relay that connects the two sides directly. The two ends then have to bring the link up again - autonegotiation and link training - so the link **drops briefly** even though it recovers on its own. - Some products add batteries or dual supplies to avoid that interruption; that is product behaviour, not a rule, and it is worth asking about before a TAP goes into a link that cannot tolerate a blip. ## SPAN versus TAP at a glance | Property | SPAN port | Passive optical TAP | Active copper TAP | |---|---|---|---| | Installation | configuration, no outage | one link break to insert | one link break to insert | | On power loss | no separate device to fail | link unaffected | brief drop while the relay closes | | Damaged frames | typically not copied | copied, it copies the light | product-dependent | | Under load | copies dropped first | copies everything | copies everything; an aggregated output can overflow | | Remote reconfiguration | yes | no, it is cabling | no | | Directions | merged onto one destination port | two outputs, one per direction | two outputs, or aggregated | ## Breakout and aggregating outputs A **breakout** TAP keeps each direction on its own output, so a 10 Gb/s full-duplex link needs two 10 Gb/s monitor ports and the tool has to merge the two streams. An **aggregating** TAP merges both directions onto one output through a buffer. It is convenient, but it inherits SPAN's oversubscription problem: once the two directions together exceed the output's rate for longer than the buffer lasts, copies are lost. **Regenerating** TAPs feed several tools with identical copies of the same link. ## Choosing between them 1. Use **SPAN** for ad-hoc troubleshooting, for watching a whole VLAN, or where no outage window exists - and accept that the copy is best effort and omits damaged frames. 2. Use a **TAP** for permanent, evidence-grade capture of a specific link, where every frame including damaged ones has to arrive. 3. Budget the outputs: two monitor ports per tapped full-duplex link for a breakout TAP, or an aggregating output sized for the sum of both directions. 4. Before inserting, check the optical budget for a passive TAP and the power-failure behaviour of an active one, and schedule the one-time link break. The short version an interviewer wants: SPAN is a free, flexible, best-effort copy made by the switch; a TAP is a dedicated, faithful copy of the wire that costs hardware, ports and an installation outage.
- Why can inserting a passive optical TAP cause errors on a link that was clean before?The splitter diverts part of each fibre's light to the monitor output and adds its own loss, so the far receiver gets less light than before. A link already near the edge of its optical budget can fall below its receiver's sensitivity and start taking errors. Check the budget, including the TAP's loss for its split ratio, before inserting it.
- When would you still choose a SPAN port over a TAP?When there is no outage window to insert hardware, when the capture is temporary troubleshooting, when you want a whole VLAN or several ports at once, or when the link is somewhere you cannot reach physically. Accept the costs that come with it: copies are best effort under load, damaged frames are typically missing, and both directions share one destination port.
saying these in an interview costs you the question
- A passive optical TAP needs power, so a power cut takes the monitored link down.
- An active copper TAP stays invisible to the link even when its power fails.
- A passive TAP can be added to a fibre link without interrupting it.
- A TAP's single output carries both directions of a busy link with no risk of loss.
- SPAN and a TAP see the same frames, so the choice is only about price.