Port Mirror (SPAN)

A helper for SPAN / port-mirror sessions on managed switches. Pick source ports, pick a destination, apply — then remove it when you’re done. Pro tier and above.

Nobody remembers monitor session syntax across vendors, because you configure a SPAN maybe four times a year and it’s a different switch each time.

Creating a session

Pick a saved switch connection, choose source ports and direction (rx, tx, or both), choose the destination port. ShellYard generates the vendor-appropriate configuration and shows it to you before applying. Read it. It’s going onto a production switch.

Removing it

There’s a Remove action, and it exists because forgetting is the actual failure mode here.

An abandoned SPAN session quietly duplicates traffic to a port forever. It survives the incident, the shift change, and often the next audit — until someone plugs a real device into that destination port and spends an afternoon on why it’s seeing traffic that isn’t addressed to it. Active sessions are listed so you can see what’s still running.

Vendor support

Follows the same switch-platform coverage as the MAC tracker — Cisco IOS and NX-OS, Aruba AOS-CX and AOS-S, Juniper Junos, Brocade. Platforms outside that set can still be driven by hand through a normal SSH session.

Note the hardware limits, which ShellYard cannot lift: most platforms allow very few concurrent sessions (often two), and a destination port stops doing its normal job while it’s a SPAN destination. Don’t mirror to an uplink.

The full workflow

1. Port Mirror — mirror the traffic you care about to a spare port
2. Plug in a host on that port, or use one already there
3. Remote packet capture — capture from that host over SSH and pull the PCAP back
4. Port Mirror → Remove — tear the session down

Via a connector

Port-mirror create and remove are exposed to MCP clients as action tools — an attached assistant can propose the session, but the approval modal appears in ShellYard before any switch configuration changes.