I've been looking at a hardware network tap like this one to replace a pseudo-permanent SPAN that's been running on a Catalyst switch. All the taps I find have four interfaces: A, B, and two output ports (one for each direction). Ideally I would prefer to funnel the traffic from both directions into one cable so I only have to capture from one interface. Why do taps always seem to have two output ports?
Network Taps – Why They Have Four Ports
packet-analysistap
Best Answer
Hardware network taps provide one output port in each direction to ensure that traffic can be replicated at line rate. For example, a 100 Mbps Ethernet connection provides a theoretical maximum of 200 Mbps of total bandwidth; 100 Mbps in each way. If you tried to capture traffic from a line which was carrying 75 Mbps in each direction, you would need at least 150 Mbps of one-way bandwidth: more than a single 100 Mbps connection can carry. Hence, taps include two output ports operating at the same speed as the line being monitored.