Network TAPs provide a "Test Access Port" for analyzing high-speed networks in half or full duplex mode.
When operating high-speed, high-capacity, data communications systems it is often necessary to monitor and analyze traffic with an
absolute minimum disturbance to the data stream.
Network taps provide inexpensive, permanent access ports throughout the network, enabling monitoring and analysis without interrupting transmission.
TAPs Advantages
TAP technology supports network monitoring and intrusion detection for almost any network configuration,
including GigaBit SX, LX or ZX; ATM, DS3, T1 and Fast Ethernet copper.
In addition, just introduced the GigaBit TX to SX tap,
the market's first copper-to-fiber tap.
Network taps are extremely reliable, featuring passive-link integrity enabling the network to operate at a
continuous flow.
These rack-mountable taps feature easy installation and broad compatibility: network managers can
simply plug in the network cables to
communicate with all major analyzer manufacturers' products including Network Generals'
Sniffer®, Agilent's Internet Advisor
& Cisco's SwitchProbe products, to name just a few.
To enable monitoring and intrusion detection, most of the major switch vendors now
support span (or mirror) ports on their switches.
This allows the traffic to be sent to an analyzer port as well as the original designated port.
First, it puts an increased load onto the switch that often increases CPU
or memory requirements.
Second, when packets are sent to a span port, most vendors' switches remove low level
(Layer 1, select Layer 2) errors from the stream of data.
This makes low level troubleshooting impossible.
Third, if the link is a full duplex link running at full line rate,
then to mirror this data would require a
span port running at full line rate to get both directions of traffic.
Unless a non-blocking switch is being used, large amounts of data could be lost
because span port traffic is a low priority.
The tap solution for network monitoring and intrusion detection utilizes passive fiber or copper splitter
taps on the main network links.
This solution mitigates the trouble and expense associated with the three drawbacks mentioned above.
TAPs Versus In-Line Connection
Another common solution for monitoring and intrusion detection is to attach the analyzer in-line.
An in-line solution has two major drawbacks:
First, because it is not cost effective to leave an analyzer in-line,
network managers must break a connection whenever they need to monitor.
Second, because the analyzer is not passive, attaching an analyzer
in-line introduces a point of failure into the network.
The permanent, passive tap solution eliminates the risk and inefficiency associated with monitoring
with an in-line analyzer connection.
Flexibility
Network taps provide network managers with the flexibility to monitor all aspects of the network 24/7.
As network security and reliability continue to grow in importance,
taps are an integral solution for any network.
Tap Types
Taps come in several varieties with different purposes and features.
If you are confused about what type of Tap device you need in your network,
here is a quick overview of the capabilities each type of Tap provides:
A standard network Tap
provides access into a single network segment and enables you to attach one monitoring device that
employs two NICs, one for each of the traffic directions on your full-duplex link.
A Port Aggregator
does essentially the same thing as a Tap; it allows you to access a single network segment.
The difference is that you can plug in one or two monitoring devices (depending on the model)
and view full duplex traffic with only a single NIC per device, rather than two NICs.
A Link Aggregator
does essentially the reverse of a Regeneration Tap. This device accepts multiple network
segments and "aggregates" all the traffic to one to four monitoring devices
(depending on the model).
The Regeneration Tap
provides the ability to plug in more than one monitoring device.
You can access a single network segment and "regenerate" the traffic
to multiple monitoring tools.
Our Bypass Switch
is specifically designed for deployments of Intrusion Prevention Systems (IPS) and other
in-line devices. It is installed in-line on a single network segment and the IPS is attached
to the Bypass Switch. If the IPS fails or is removed, the Bypass Switch maintains the
network connection while the IPS is offline.
The
Director data monitoring switch is our new, state-of-the-art filtering appliance.
It combines many of the functions above, such as tapping, regeneration, and
link aggregation while providing Layer 2 to Layer 4 filtering.
Several models are available to provide multiple levels of throughput.
If you are using a hub or a Span port to get monitoring access to your network, you need a Tap!
