What Is a Network Tap?
On this page
A network tap is a device placed inline on a link that copies all the traffic crossing it and sends that copy to a monitoring tool — without disrupting the original flow. It is how defenders get a complete, reliable view of network traffic to feed traffic analysis and IDS/IPS. You cannot analyze what you cannot see, and taps are how you see everything.
How does a tap work?#
A tap sits between two devices on a link and passively duplicates the traffic. Because it is a dedicated, often fail-safe device, the monitored link keeps working even if the tap or monitoring tool fails, and the copy it produces is complete — nothing sampled away or dropped.
Tap vs SPAN port#
The common alternative is a switch’s SPAN (mirror) port. The trade-off:
| Network tap | SPAN port | |
|---|---|---|
| Type | Dedicated hardware | Switch feature |
| Completeness | Full, reliable | Can drop under load |
| Cost | Extra hardware | Free (built in) |
| Switch impact | None | Consumes resources |
SPAN is convenient and fine for many uses, but under heavy load it silently drops packets and steals switch capacity. For accurate, high-fidelity monitoring — especially at critical links — a hardware tap is the dependable choice.
Network taps provide the reliable visibility that detection depends on. More at the Network Security hub.
Frequently asked questions#
What is a network tap?
A network tap is a hardware device inserted into a network link that makes a copy of all traffic passing through it and sends that copy to a monitoring tool. Because it is a passive, dedicated device, it captures traffic completely and reliably without altering the original flow — the gold standard for network visibility.
What is the difference between a tap and a SPAN port?
A SPAN (or mirror) port is a switch feature that copies traffic from selected ports to a monitoring port — convenient and free, but it can drop packets under load and consumes switch resources. A hardware tap is a dedicated passive device that copies everything reliably even at full capacity. Taps are more accurate; SPAN is more convenient.