Before reading this topic, you may check also following questions:
The Port Miroring feature was introduced on switches because of a fundamental difference that switches have with HUBs. When a HUB receives a packet on one port, the HUB sends out a copy of that packet on all ports except on the one where the HUB received the packet.
After a switch boots, it starts to build up a Layer 2 forwarding table on the basis of the source MAC address of the different packets that the switch receives. After this forwarding table is built, the switch forwards traffic that is destined for a MAC address directly to the corresponding port.
In a contrast to a HUB (which is a "dumb" repeater), managed switch with port mirroring feature is a "smart" repeater: it allows a configuration of which port(s) to monitor and where to send a copy of received packets. So, a copy of packets are sent to only one destination (analysis) port, while HUB sends copy of packets to all ports.
| HUB | Managed Switch with Port Mirroring | |
| Performance | acceptable for 3-5 devices, connected to a HUB | high performance |
| Configuration | no configuration available | configuration via web or command line interface |
| Source ports for monitoring | all ports are permanently mirrored | administrator can specify which port or ports (or even VLAN) should be mirrored |
| Destination ports for monitoring | all ports on a HUB receive a copy of packets, which are transmitted through a HUB. | only single port can be configured to receive a copy of packets, which are sent through monitored ports. Althoug some of switches support multiple mirror sessions. |
