An efficient mechanism for wire-tapping network traffic is disclosed. In
one embodiment of the invention, a primary forwarding lookup process and
a secondary forwarding lookup process are performed in parallel and
independently of each other. The primary forwarding lookup process
determines the output interface to which the packet is to be routed
regardless of whether the packet is to be intercepted. The secondary
forwarding lookup process determines whether the packet is to be
intercepted and also determines the output interface to which a copy of
the packet is to be routed. Because the lookup processes are performed
independently and in parallel, normal packet forwarding can be performed
at line rate or near line rate while the packets are intercepted.