The do’s and do not's of SPAN ports!
A mirror or SPAN (switch port analyser) port can be a very useful resource if used in the correct way. SPAN ports are typically found on network switch gear although their features vary among switch vendors. They are commonly used for network appliances or software applications that require monitoring of network traffic, such as an intrusion detection system or application performance management.
While all this sounds great you do need to be very careful with the way you use SPAN ports. On the Cisco Catalyst 5500/5000 and 6500/6000 series switches, a packet received on a port is transmitted on the internal switching bus. Whether one or several ports eventually transmit the packet has absolutely no influence on the switch operation.
The problems with SPAN ports start when you overload them with data. A typical example would be where someone has a bunch of servers connected to a core switch and they try and mirror all of these ports to a single SPAN port. Chances are the port will become oversubscribed resulting in dropped packets on the SPAN port. In some extreme cases the switch may even throttle back on its own operations if the SPAN port is receiving too much data.