Analyzing Full-Duplex Networks
There are a number ways to access full-duplex traffic on a network for analysis: SPAN or mirror ports, aggregation TAPs (Test Access Ports), or full-duplex TAPs are the three most common. This paper discusses the issues involved in deciding which type of technology to deploy. In short, your answer will depend on the rate of traffic being monitored, and the level of visibility you require.
This paper describes the advantages and disadvantages of three common methods of accessing traffic from full-duplex networks for purposes of analysis, monitoring, or forensics.