Disclosed are methods and apparatus for data tapping within a storage area network (SAN) and providing tapped data to a third party device, such as an appliance. In general, mechanisms are provided in a SAN to allow a data tap of data flowing between an initiator and a target. In one implementation, a data virtual target (DVT) in created in a network device to intercept data sent by a specific initiator to a specific logical unit of a specific target. The data or a copy of the data is sent to both the specific logical unit of the specific target and to an appliance. The data routing may be accomplished by use of a virtual initiator (VI), which is configured to send the data (or a copy of the data) to the specific target and the appliance. In a transparent mode of operations, the DVT has a same PWWN (port world wide name) and FCID (fibre channel identifier) as the specific target. In a first proxy mode of operation, the DVT has a different PWWN and FCID than the specific target. In a second proxy mode of operation, the DVT has a same PWWN and different FCID than the specific target.