1. A network element for performing tap aggregation, the network element comprising:a first tap port to couple with a tap switch;
a set of tool ports to transmit network data received from the first tap port to a data analyzer; and
data plane logic to manage a mapping between the first tap port and the set of tool ports, wherein a first tool port in the set of tool ports is to perform egress truncation and the data plane logic is to perform a selective copying action to truncate a first unit of network data to be forwarded to the first tool port and a forward action to forward a second unit of network data to a second tool port in the set of tool ports without truncation.