When A Simple SPAN Port Is Enough
The two most common ways to access and replicate data within your network are TAP and SPAN technology. A Test Access Point (TAP) is a hardware device that copies all of your network data. SPAN or Switch Port Analyzer are mirroring ports within a switch that copies specific data as a best effort with no guarantees.
Network TAPs are always the industry's best practice but in a few specific and limited situations when a SPAN port suffices. When monitoring products are looking for low bandwidth application layer events like “conversation or connection analysis,” “application flows,” and applications where real time, dropped packets and knowing real delta times are not important. SPAN could also be used in a remote location that doesn’t justify a permanent deployment, offering temporary access for limited troubleshooting.
In these specific situations when a SPAN port perfectly suffices, you likely need a way to aggregate a few SPAN lines together and send that combined network traffic out to one or more sets of tools or appliances. When these situations arise, think simplicity.