What distinguishes a physical tap from a port mirror?

The distinction between a physical tap and a port mirror primarily revolves around how data is accessed and captured from a network link. A physical tap, or network tap, is a device that connects to the physical network medium and intercepts the data in transit. It captures all packets that pass through the link without affecting the actual traffic flow. This means that it does not introduce any load on the network while it provides a complete and uninterrupted view of the data stream.

On the other hand, a port mirror, also known as a SPAN (Switch Port Analyzer), is a function that is configured on network switches to replicate the traffic from one port (or more) to another designated port for monitoring purposes. This process relies on the switch's software capabilities to direct traffic to the mirror port and may have limitations such as not capturing all packets (due to possible overload) during peak traffic, since it utilizes switch resources to perform the mirroring.

In summary, the correct answer emphasizes that physical taps intercept the data physically via direct connection, ensuring a complete and unaltered capture of network traffic, whereas port mirrors rely on software configurations and can introduce some limitations in high-traffic situations.