SPAN vs RSPAN: Port Mirroring for CompTIA Network+

Port mirroring, specifically SPAN (Switched Port Analyzer), copies network traffic from one port to another for monitoring. Local SPAN mirrors traffic within a single switch, while RSPAN (Remote SPAN) allows traffic to be mirrored across multiple switches via a dedicated VLAN, enabling centralized IDS/IPS placement and analysis.

What Exactly is Port Mirroring and Why Do You Need It?

Back in the day, we had hubs that broadcasted every packet to every port. It was a security nightmare but a dream for troubleshooting. Once switches took over, they started making intelligent forwarding decisions based on MAC addresses, which effectively blinded your monitoring tools. If you plug an Intrusion Detection System (IDS) into a standard switch port, you'll only see broadcast traffic and packets specifically destined for that IDS.

That is where port mirroring comes in. In the context of the CompTIA Network+ (N10-009) exam, you need to understand that port mirroring allows you to selectively copy traffic from a 'source' port (or an entire VLAN) and send it to a 'destination' port where your analyzer lives. Whether you are hunting for a malware infection or troubleshooting a latency issue, port mirroring is your primary window into the actual data flowing across your wire.

How Does Local SPAN Work in a Real-World Scenario?

Local SPAN, or Switched Port Analyzer, is the most straightforward form of mirroring. You configure the switch to take every packet entering or leaving Port A (the source) and send a duplicate copy to Port B (the destination). This happens entirely within the hardware of a single switch. It is the go-to move when you have a physical server or a laptop running Wireshark that you can plug directly into the same switch as the target device.

From a practical standpoint, you must be careful with your port selection. If you are mirroring a high-traffic trunk port that is pushing 800 Mbps of data and your destination port is only a 1 Gbps link, you are cutting it close. If the source traffic exceeds the destination port's capacity, the switch will simply drop the mirrored packets. You won't crash the network, but you'll have gaps in your data, which can make a security audit a total disaster.

When Should You Upgrade to RSPAN Architecture?

Local SPAN is great until your network grows. Imagine you have a campus with ten switches, but your expensive IDS/IPS appliance is located in a single centralized data center. You can't run a 100-meter copper cable from every single switch back to that one appliance. This is where RSPAN (Remote SPAN) saves the day. RSPAN allows you to mirror traffic on a remote switch and carry that mirrored data across your network to a different switch where your monitor is plugged in.

To make this work, we use a dedicated RSPAN VLAN. The source switch copies the traffic and tags it with the RSPAN VLAN ID, routing it across the network to the destination switch. This is a critical concept for the Network+ exam: remember that RSPAN consumes actual bandwidth on your trunk links. If you mirror a massive amount of traffic across your backbone via RSPAN, you risk congesting your production traffic, potentially slowing down the very network you are trying to protect.

Where Should You Place Your IDS/IPS for Maximum Visibility?

Knowing how to mirror traffic is one thing; knowing where to do it is where the real expertise comes in. To get the most bang for your buck, you should place your monitoring tools at 'choke points.' Mirroring the port connected to your edge router or firewall allows you to see all North-South traffic (traffic entering or leaving your network). This is your first line of defense for detecting external attacks.

However, modern threats often involve lateral movement, where an attacker jumps from one internal workstation to another. To catch this, you should mirror traffic from your core switches or the ports connected to your most sensitive servers. By strategically placing your IDS/IPS and using a mix of SPAN and RSPAN, you create a visibility matrix that leaves attackers with nowhere to hide. When you're studying for the N10-009, think about the 'flow' of data and place your mirrors where the most critical transitions occur.

How Do You Manage Bandwidth Contention on Destination Ports?

One of the most common mistakes I see junior admins make is ignoring the 'over-subscription' problem. If you mirror three different 1 Gbps ports into a single 1 Gbps destination port, you are attempting to push 3 Gbps of data through a 1 Gbps pipe. The switch cannot buffer this amount of data; it will simply discard the excess packets. This results in 'packet loss' in your capture, which can lead to incomplete TCP streams and misleading analysis.

To avoid this, you have a few options. First, ensure your destination port is the fastest link available (e.g., mirroring 1 Gbps ports into a 10 Gbps port). Second, be selective about what you mirror. Instead of mirroring 'both' directions of traffic, you might only mirror 'ingress' (incoming) traffic if that's all your IDS needs. In the real world, if you hit a bandwidth ceiling, you may need to look into dedicated Network TAPs (Test Access Points), which are hardware devices that copy traffic without relying on the switch's CPU.

How Do You Properly Configure and Verify Monitoring Sessions?

Configuring a monitoring session generally follows a three-step process: define the source, define the destination, and verify the flow. In a CLI environment, you'll specify the interface you want to watch and the interface where the sniffer is attached. Once applied, always verify the session status. I recommend running a simple ping test from a device on the source port and checking your analyzer to ensure the packets are actually arriving.

Mastering these concepts is a huge part of the Network+ exam, but reading about it isn't enough—you need to apply it. That's why we built Cert Sensei to bridge the gap. We offer 1,000 expert-curated CompTIA Network+ (N10-009) practice questions that challenge you with real-world scenarios exactly like these. With detailed expert reasoning for every answer and domain-level analytics, you can pinpoint exactly where your knowledge of switching and mirroring is weak and fix it before exam day.

❓ Frequently Asked Questions