Method to associate input and output interfaces with packets read from a mirror port

The network monitoring system includes a monitor device coupling to a network switch through a mirror port interface of the network switch. The network switch supports a number of regular port interfaces connected to different network components and the mirror port connected to the monitor device. The mirror port mirrors all network traffic of any selected regular port interfaces of the network switch. When the monitor device receives a data packet from the network switch, the monitor device extracts the network address information from such as the source and destination address from the data packet. The monitor device then examines internal lookup tables to determine whether there are corresponding physical port interface for the network address information. If the corresponding physical port interfaces for the network address information are not available in the lookup table, the monitor device interrogates the network switch for the corresponding physical port interface. The network address information is placed in a first-in-first-out buffer temporarily until the network switch responses to the monitor device's request. Finally, the monitor device uses the physical port interface to perform further network analysis functions.