Local SPAN

Switch Port Analyzer (SPAN) is an efficient, high performance traffic monitoring system. It mirrors traffic from one or more interfaces or VLAN to one or more interfaces on the same switch. This method is also called as Local SPAN.

In this method appliance is connected to the switch at the same location as the switch and can be connected directly to one of the switch ports

The switch has a spare port that can be dedicated for mirroring. The passive sensor is physically co-located with the switch and is directly connected to the mirror port. For this, the SPAN method should be used.

The following image shows the connectivity for a physical appliance. You can see that the sniffing interface of the appliance is connected to the network switch, and mirrored traffic is fed from the switch to the appliance. The management interface connects to the Qualys Enterprise TruRisk™ Platform.

The following picture shows connectivity for a virtual appliance. The virtual appliance is supported on the VMware ESXi Server virtualization platform and Microsoft Hyper-V. Again, the sniffing interface is fed mirrored traffic from the network switch. The management interface is configured to connect to the Qualys Enterprise TruRisk™ Platform.