SPAN ports problems

[Network Digger]

I read that SPAN ports are not accurate and that TAPs are better, this is because SPAN ports do not keep layer 1 and 2 information, as they drop undersized and oversized packets, and packets with CRC errors and usually remove VLAN tags, but I don't understand why the SPAN ports will cause all these problems, can I get more info about this plz?? Thanks. 

[EduardR]

Hi,

I think the word "accurate" is not accurate, the SPAN and the TAP are essentiatly different, the TAP just copies all the electric or optic signals over the wire, including the errors and all that could be wrong in the ports (physically too) and redirects all to another port, the downside is that you need some specialized equipment to really use all that information. The SPAN port is some routine that works inside the switches (probably in the ASICs) and copies all the data that traverses the chipset, but if the physical port has something bad, it cant be replicated in the SPAN (as the traffic has not passed there yet).

So, the question is, why are you using the mirrored traffic? depending on that answer you can decide if it is betther to use a SPAN port, or a TAP.

[Network Digger]

Hi Eduard, can u give me more details plz about the part (if the physical port has something bad, it cant be replicated in the SPAN (as the traffic has not passed there yet)), as I still cannot understand which part exactly won't be replicated, I thought the traffic is already received by the ASIC and then will be replicated as is.

[sathvik k v]

Hello,

Few months back i was looking advantages of TAP over SPAN. I found this URL which helped me understand better. Hope this helps. 

https://observer.viavisolutions.com/includes/popups/taps/tap-vs-span.php

Regards,

Sathvik

[EduardR · Accepted solution]

Hi! Lets think about one RJ45 port that has some defective pin, or with some damaged connection with the ASIC hardware, this issue can make your network a nightmare  (some time ago we got some defective port that cause a loop in a production environment) and if you want to check it in a SPAN port you got nothing, because that type of problem are only perceptible after the traffic has passed thru the ASIC.

The same with optical SFP hardware issues, or just a simple dust in one of the fiber terminals.

[Network Digger]

Many thx, it is clear now :)