A method of operating a network visibility node is disclosed. In certain embodiments, the network visibility node has a plurality of network ports through which to communicate data with a plurality of network hosts and has a plurality of tool ports through which to communicate data with a plurality of network tools. The network visibility node accesses a port group map associated with a plurality of tool port groups of the network visibility node, where each of the tool port groups includes one or more tool ports of the network visibility node, and where the port group map contains a separate tool alias for each tool port group of the plurality of tool port groups. Each tool alias can correspond to a different type of network traffic. The network visibility node uses the port group map to ascertain a tool port group through which to communicate the plurality of packets with a particular network tool.