Tapping the network for monitoring and analysis

See how Taps provide reliable, secure and economical access to network traffic for monitoring and analysis solutions.

Networks have evolved, and so have the solutions used to keep them up and running smoothly.  Today’s IT professionals, who historically were primarily responsible for layer 2 and 3 switching and routing issues, are also concerned with application performance, network security and regulatory compliance.  To support the network and effectively manage all these issues and concerns, network engineers and managers utilize a variety of support solutions: network management and monitoring systems, network analyzers, application analyzers, security probes, packet recorders and handheld testers.  A common technique for improving the return and effectiveness of these solutions is to leverage network taps for increased visibility, manageability and flexibility.

To do its job, a network support solution (i.e. a network monitor, analyzer, or probe) needs to be fed a constant stream of relevant network traffic.  One technique for accessing network traffic is to configure a port mirror.  A port mirror is a software based connection that is created inside a network device, usually an Ethernet switch or router.  The port mirror makes copies of traffic coming from one or more ports on the Ethernet switch and copies the traffic to the port mirror.  When an analyzer or probe is connected to the port mirror, in theory it will see all the traffic coming from the designated ports.

Network topology using port mirrors and multiple probes

An inline network Tap is an alternative to a port mirror.  An inline Tap connects directly into a network link between two network devices.  The Tap does not actively participate in network switching, bridging or routing.  As traffic passes through the Tap, a copy is forwarded to a monitoring port(s).  Connectivity is maintained between devices even if power is removed from the Tap.  Unlike a port mirror, a Tap will not drop traffic due to Ethernet switch congestion, it is easier to configure and is more secure.

An aggregation Tap can minimize the number of devices required for network monitoring and analysis.  Rather than an analyzer or probe for each critical network link, traffic from multiple links can be directed to a single aggregation Tap.  The aggregation Tap combines the traffic from multiple sources into a single monitor port.  An analyzer or probe connected to the monitor port now has visibility into multiple links, maximizing the value of each analyzer or probe.

A span Tap, or regeneration Tap, creates identical copies of traffic so that multiple network support solutions can all access the same data.  Span Taps are extremely useful when different departments within a business each require access to the same network traffic for their specific needs: network support, application analysis, network security, packet capture, etc.


Deployment utilizing inline and aggregating span Taps

Today, Taps are available that integrate all three attributes: inline, aggregation and span.  Taps are also capable of filtering inbound traffic so that only the most relevant data is passed out the monitor port(s).  Taps support a wide variety of network media and speeds.  Network Taps maximize the effectiveness and value of network support solutions.