A
network TAP (Test Access Point) passively copies all network traffic to a monitoring port without interrupting the connection — for IDS, forensic capture, or traffic analysis.
TAP is passive — it can't fail and break the link. SPAN/mirror port is an alternative using switch software but may drop packets under load. TAPs are preferred for high-speed forensic capture.