Q:

Port SPAN similar to MAC flooding?

I wanted to know if a SPAN port on a switch (which is used to monitor all packets passing through the network) is similar to any other port if a mac flooding attack is performed.

A:

Not really. A SPAN interface is primarily used as a one-way interface; copied traffic goes out. The monitoring equipment on the SPAN interface has no real need to send any traffic into the switch, so there isn't much, if any, traffic that would be redirected from the SPAN interface.

