A SPAN port and a network TAP are two technical ways to passively copy network traffic so it can be read and analyzed — without interfering with the live data flow.
In detail
A SPAN (mirror) port is configured on a switch to send a copy of traffic to a monitoring device; a TAP is a hardware device inserted into the link for the same purpose.
Both enable passive observation — the monitoring tool reads a copy and changes nothing on the production network.
AEGYS Pulse connects via SPAN port or TAP — passive, no interference.
Last updated: 5 June 2026 · 4 min read