Disclosed is a session modification mechanism for altering a data tapping process in a storage area network (SAN). In general, a data tapping mechanism is set up so that an appliance receives SAN data that is tapped from a particular SAN session. That is, the data tapping mechanism provides to a particular appliance a copy of the SAN data that is being written from a particular host to a particular storage device. The session modification mechanism allows the appliance to alter various aspects of the SAN session that is to be (or is being) tapped. Examples of various modification features includes (i) redirecting READ commands initiated by the host to the appliance and not sending such command to the storage device, (ii) redirecting both READ and WRITE commands initiated by the host to the appliance and not sending such commands to the storage device, (iii) halting redirection and thereby causing READ commands initiated by the host to be sent to the storage device and WRITE commands initiated by the host to be mirrored to both the storage device and appliance, (iv) quiescing and unquiescing all data I/O's for the particular storage device and appliance, and (v) stopping and starting the data tapping mechanism.