How can I split one SPAN port between two security tools?

First check whether the edge switch can mirror the same sources to a second destination port. That avoids another device in the capture path, though it depends on the switch model and its mirror session limits.

If it can, check the destination port counters and compare what each tool receives under load. A SPAN output can drop traffic before either tool sees it, especially during bursts.

A small managed switch with port mirroring may do the job. Feed the existing SPAN output into one port and configure that port as the source for two mirror destinations, one for each tool. Check the model's documentation first because mirror destination and session limits vary.

Test with representative burst traffic and look for drops on both the source and replication switch. This is a cheaper option worth investigating, not a guarantee of lossless copies.

For a dedicated appliance, look for a gigabit copper regeneration TAP or packet broker with one monitoring input and at least two monitoring outputs. Dualcomm ETAP-2105 is one candidate to check. Confirm the port roles and replication behavior before ordering, since an aggregation TAP with one output doesn't solve this.

Ask the vendor about buffering, drop counters, burst handling and availability. Even a capable replicator can't recover packets already dropped by the original SPAN port.

I wouldn't use a cheap passive copper splitter for this. Gigabit copper isn't a hub-style connection, so splitting the cable isn't a substitute for an active device that receives and replicates packets.

Fiber splitting is a different setup and would require compatible optical ports or converters. It isn't a direct solution for the existing copper output.