What is SPAN?
SPAN (Switched Port Analyzer), also known as port mirroring, is a function of a managed switch that copies the traffic of one or more source ports or VLANs to a separate monitor port, so that an analyser or sensor can inspect that traffic without taking part in the communication itself. The name SPAN comes from Cisco; other vendors, including makers of industrial switches, call the same function port mirroring. In OT networks, SPAN is the cheapest and quickest way to make communication between PLCs, HMIs and SCADA systems visible to Wireshark, an IDS or a SIEM.
🧠 How does SPAN work?
A SPAN session always consists of three elements that the administrator configures on the switch:
- Source - one or more ports, or an entire VLAN, whose traffic should be copied
- Direction - received traffic only (rx), transmitted traffic only (tx) or both; on most switches “both” is the default
- Destination - the monitor port to which the analyser or monitoring sensor is connected
The switch copies every frame that matches the source criteria in hardware and sends the copy out of the monitor port. The original frame is forwarded as usual, so production communication is in principle unaffected. On Cisco Catalyst switches, the destination port does not take part in Spanning Tree while a session is active and accepts no incoming traffic by default, so the connected device cannot send anything back into the network.
SPAN is read-only monitoring: you observe the network without sending packets to sensitive controllers yourself.
🔧 What variants of SPAN exist?
Local SPAN works within a single switch. If you want to analyse traffic from a switch in a field cabinet on a sensor in the server room, there are two extensions:
| Variant | How it works | Transport | Typical OT use |
|---|---|---|---|
| Local SPAN | Source and monitor port on the same switch | None, the copy stays local | Sensor right next to the core or distribution switch |
| RSPAN (Remote SPAN) | Copy travels over trunks to another switch in a dedicated RSPAN VLAN | Layer 2, flooded VLAN without MAC learning | Several switches on one site, one central sensor |
| ERSPAN (Encapsulated Remote SPAN) | Copy is wrapped in GRE and routed over IP | Layer 3, across routers | Distributed sites, sensor in another subnet |
The number of sessions is limited. A Cisco Catalyst 9300, for example, supports at most eight source sessions per switch, and RSPAN and ERSPAN sources count towards that limit. ERSPAN Type III adds a timestamp with 100 ns resolution, which helps when you want to analyse latency or jitter. Many compact industrial switches only support local port mirroring, often with a single session; check the manual for your model.
🏭 What is SPAN used for in industrial networks?
- Protocol analysis - inspecting Modbus, ProfiNET, S7, DNP3 or OPC UA traffic with Wireshark during faults or commissioning
- OT threat detection - feeding an IDS or an NDR platform such as Nozomi, Claroty or Dragos with a continuous, real-time copy of the traffic
- Asset inventory - building an asset inventory passively, without active scans that can make older PLCs hang
- Commissioning - following BOOTP and DHCP behaviour while addressing new drives or O modules
- Forensics - recording traffic during an incident to support incident response
- Audits and documentation - establishing which communication actually takes place, as a basis for network segmentation and firewall rules
SPAN is usually configured on core or distribution switches and at the boundaries between levels of the Purdue Model. That is where much east-west and north-south traffic converges, so one sensor sees a lot. It is the usual tapping point for passive monitoring.
🔍 What is the difference between SPAN and a TAP?
A TAP is a separate hardware device that is physically inserted into the cable. SPAN is a software function of the switch you already own. Both have their place:
| Aspect | SPAN (switch-based) | TAP (hardware-based) |
|---|---|---|
| Cost | No extra hardware required | A separate TAP per link |
| Installation | Configured via CLI or web interface, without interruption | The cable must be disconnected briefly |
| Completeness | Errored frames (CRC errors, runts) are not copied | A passive TAP copies everything, including errored frames |
| Behaviour under load | The copy has lower priority; excess is silently dropped | A passive TAP misses nothing; an aggregating TAP can still overflow |
| Timing | Copies may arrive delayed or out of order | Timing stays virtually original |
| Flexibility | Source quickly changed, including whole VLANs | Fixed to one link |
| Use in OT | Ad hoc analysis and broad monitoring | Critical links and forensic evidence |
A note on copper: a TAP is only truly passive up to 100 Mbit/s. Gigabit copper requires active electronics, and the TAP should then have a fail-safe relay so that the link keeps working during a power failure.
📏 How do you size and configure a SPAN port?
The biggest pitfall is oversubscription of the monitor port. A 1 Gbit/s full-duplex link can carry 2 Gbit/s in both directions combined, while the monitor port can only transmit 1 Gbit/s. If you mirror a whole VLAN or several uplinks, all of that traffic adds up. Whatever does not fit is dropped by the switch without warning, resulting in packet loss in your analysis. A practical approach:
- Measure first - check the bandwidth of the source ports through SNMP counters or switch statistics
- Choose the source sparingly - prefer the uplink of a cell to all individual ports, because traffic between two mirrored ports is otherwise copied twice
- Use a faster monitor port (for example 10 Gbit/s) when the source runs close to capacity
- Keep the monitor port exclusive - connect only the sensor and never place it in a production VLAN
- Verify the sensor - compare the number of packets received with the switch counters and check that TCP sessions are complete
- Document the session in the network design so that a technician does not reuse the port by mistake
In OT networks, traffic per cell is usually modest: cyclic ProfiNET communication typically uses only a fraction of a 100 Mbit/s link. The risk lies mainly in mirroring backbone links of the industrial Ethernet, rings running MRP or RSTP, and video or engineering traffic that causes peaks.
🔐 How do you secure a SPAN port?
A SPAN port sees all traffic from the source, including passwords in unencrypted protocols. That makes it an attractive target for attackers:
- Physical - use a labelled port in a locked cabinet and disable unused ports
- Logical - connect only trusted sensors and configure the capture NIC without an IP address, so the sensor cannot be reached through the monitor interface
- Separate management - give the sensor its own management interface in a management VLAN, shielded with ACLs and a firewall
- Log changes - record configuration changes to SPAN sessions via Syslog and forward them to the SIEM; an unexpected new session may indicate an attacker who is listening in
- Data flow to IT - if the copy has to reach a central OT SOC, consider a data diode between the sensor and the IT network
SPAN is not a security control in itself, but a tool within network monitoring and defence in depth.
🇪🇺 Why is SPAN relevant for IEC 62443 and the Dutch Cybersecurity Act?
IEC 62443 requires continuous monitoring of the control system in system requirement SR 6.2 of part 3-3. For existing installations with legacy PLCs, passive monitoring through SPAN or a TAP is often the only practical way to meet that requirement. The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026 as the implementation of NIS2, obliges essential and important entities to take appropriate measures and to report significant incidents. Detecting and substantiating incidents in time requires visibility into OT traffic, and a SPAN port is usually the first tapping point for that.
❓ Frequently asked questions
Is SPAN the same as port mirroring?
Yes, SPAN and port mirroring describe the same function: a switch copies traffic from source ports to a monitor port. SPAN is Cisco’s term, while many other switch vendors, including makers of industrial switches, call the function port mirroring.
Can a SPAN port disrupt the production network?
A correctly configured SPAN session does not disrupt production traffic, because the switch forwards the original frame as usual and gives the copy a lower priority. Problems arise mainly from configuration errors, such as a monitor port that also carries production traffic or an RSPAN VLAN flooded across busy trunks.
Why is my analyser missing packets on the SPAN port?
A SPAN port misses packets when more traffic is mirrored than the monitor port can transmit, for example both directions of a fully loaded gigabit link. In addition, SPAN does not copy frames with CRC errors or undersized frames, so physical cabling problems stay invisible.
When should you choose a TAP instead of SPAN?
A TAP is the better choice for critical links, for forensic investigations where every packet counts and for switches without port mirroring. SPAN is sufficient for ad hoc analysis, for broad monitoring of VLANs and when interrupting a cable to install a TAP is not acceptable.
What is the difference between SPAN, RSPAN and ERSPAN?
Local SPAN copies traffic to a port on the same switch. RSPAN carries the copy to another switch in a dedicated VLAN, and ERSPAN wraps the copy in GRE so it can travel across a routed IP network to a remote sensor.
Do industrial switches have a SPAN function?
Most managed industrial switches support port mirroring, often with a single local session and without RSPAN or ERSPAN. Unmanaged switches lack this function; there you need a TAP or a replacement managed switch.
📌 In summary
SPAN turns an existing managed switch into a tapping point for analysis and detection. It is cheap and flexible, but it does not copy everything: errored frames are missing and packets disappear silently when the monitor port is oversubscribed. With proper sizing, an exclusive and protected monitor port, and TAPs on the critical links, SPAN forms the basis of passive OT monitoring.
SPAN makes network traffic visible without intervening in the communication, making it the first step towards monitoring, troubleshooting and forensic investigation in OT environments where availability comes first.