Black Box TS250A, Manual, Page: 8 / 64

Security, convenience, and dependability
Chapter 1 TAPs Overview 8
rev. 1
Thank you for purchasing the TAP: the most robust, secure, and
convenient mechanism for network analyzers and similar devices to
copy data streams from high-capacity network links.
A network Test Access Port (TAP) provides access to the data streams
passing through a high-speed, full-duplex network link (typically
between a network device and a switch. The TAP copies both sides of
a full-duplex link (copper or optical, depending on type of TAP), and
sends the copied data streams to an analyzer, probe, intrusion
detection system (IDS) or any other passive analysis device. There are
different TAP models available to monitor both copper and optical
links.
Security, convenience, and dependability
The security and convenience of a TAP makes it preferable to inline
connections for network analysis and intrusion detection and
prevention (IDS/IPS) applications. Because a TAP has no address on
the network, the TAP and the analyzer connected to it cannot be the
target of a hack or virus attack. TAPs are economical to install,
allowing you to leave them permanently deployed. This allows you to
connect and disconnect the analysis device as needed without
breaking the full-duplex connection, much like plugging in an
electrical device.
A TAP is also preferable to using a switch’s SPAN/mirror port to copy
the data stream. Unlike the SPAN/mirror port, a TAP will not filter
any errors from the data stream. Also, because a SPAN/mirror port is a
half-duplex link (that is, a send-only “simplex” data stream), it has the
capacity to transmit only half of a fully-saturated link. Additionally, a
TAP does not use any of the switch’s CPU resources.
Deciding whether to use a TAP or a SPAN/mirror port
A TAP is a passive splitting mechanism installed between a device of
interest and the network. A TAP copies the incoming network traffic
and splits it. It passes the network traffic to the network and sends a
copy of that traffic (both send and receive) to a monitoring device in
real time. A switch cannot pass physical layer errors (poorly formed
packets, runts, CRCs) to the analyzer, but a TAP will.