What is the difference between a tap and a SPAN?

A network tap is a dedicated hardware device used to capture or sniff the data traffic flowing across the network. Many taps do not require configuration. They will typically have three physical ports: A, B, and Monitor.

On the network segment that you want monitored, you would unplug the ethernet cable from the switch or router, plug that cable into port A, plug another cable into port B and connect that back to the switch or router (whichever is not already connected), and then plug a cable into the Monitor port and the other end of it into the Alert Logic® appliance. 

SPAN (Switched Port Analyzer) is a Cisco Systems term and feature that is sometimes called port mirroring or port monitoring. It selects network traffic for analysis by a network analyzer. This is configured by the customer.

The Alert Logic agent component, tmhost, is a software tap that replaces the need for a physical network tap or SPAN configuration.

Note: Alert Logic does not have access to customer and partner account network switch configurations.