Black Box TS250A, Manual, Page: 13 / 64

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview
13
rev. 1

Routes the integrated signal to the send channel of the SPAN/
mirror port
Each of these activities burdens the switch’s internal processor. These
demands on the switch’s CPU have implications for both your
monitoring equipment and general network performance. Using a
SPAN/mirror port to capture network traffic for analysis presents the
following risks:

As total bandwidth usage for both channels exceeds the
capacity of the outbound link to the analyzer, the excess
traffic is dropped from the analyzer stream. There simply is
not enough bandwidth to transmit both sides of the full-
duplex traffic across a single standard interface.

The switch’s CPU must act as both a network switch and a
packet-copier. The switch’s CPU must also integrate the two
data streams (send and receive) together correctly. Both
packet copy/re-direction and channel integration is affected
by switch load. This means the SPAN/mirror port may not
deliver accurate captures when the switch are under heavy
load. Monitoring a 10/100 network through a gigabit SPAN/
mirror port and analyzer does not alleviate these concerns.
Also, there is no notification when the SPAN/mirror port is
dropping packets or delivering inaccurate time stamps.
A SPAN/mirror port can deliver satisfactory results when used to
monitor lightly used, non-critical networks. If network utilization
exceeds the capacity of the outbound (analyzer) link, packet loss
results—which invalidates many types of analysis, and makes
monitoring for certain kinds of network activity impractical. For
example, you might miss a virus signature because packets are being
dropped. When analyzing a transaction or connection problem, the
analyzer may detect problems where none exist because expected
packets are being dropped by the SPAN/mirror port. Hardware and
media errors will also be impossible to troubleshoot through a SPAN/
mirror port, as these errors are not mirrored to the analyzer.