A network sniffer, also known as a network Test Access Port (TAP) allows you to view the data on an ethernet link. Packets flowing through the NETWORK ports are duplicated to the TAP port(s). The TAP port is typically connected to a PC running Wireshark. or similar software.

The SharkTapSFP works with SFP modules, supporting copper and fiber up to 10Gbit. All other models work with copper: Specifically, 10, 100, and 1000Base-T ethernet links.

The SharkTaps are designed to be "like it's not even there" to the link it is monitoring. We use a copper repeater architecture that introduces virtually zero delay and is protocol agnostic. The SharkTaps are not SPAN ports or switches with port mirroring. They copy data at the bit level, and can duplicate data that isn't even proper IP packets. The SharkTaps are "aggregate" taps, meaning that they combine packets from both network ports and send them to a single TAP port. This is more convenient than taps that require two NICs on the your PC, but is not optimal if your link will have sustained total data rates above 1Gb/sec. The SharkTapSFP+ is different in that it works with SFP(+) modules that have their own behaviors. But the SharkTapSFP itself copies data between ports with no delay or modification of data.

Why not just use a standard switch to add a port? Conventional switches route packets only to the intended destination port, reducing traffic, but preventing a third port from seeing all packets. You need something to duplicate all packets to or from the 'NETWORK' ports on the 'TAP' port.