2
10/100 Copper nTAP - 6
Chapter 2: Why choose
a TAP or SPAN port
Choosing between a SPAN, Aggregator, or full-duplex
TAP
Whether you use a SPAN/mirror port, aggregator TAP, or full-duplex TAP depends
on the saturation level of the link (up to 200% of link speed when both sides are
combined) you want to monitor and the level of visibility you require.
There are numerous ways to access full-duplex traffic on a network for analysis:
SPAN/mirror ports, Aggregator TAPs, or full-duplex TAPs are the three most
common.
Each approach has advantages and disadvantages. SPANs and Aggregator TAPs
are designed to work with a standard (and usually less expensive) network
card on the analysis device, but their limitations make them less than ideal for
situations where it is necessary to guarantee the visibility of every packet on the
wire.
A full-duplex TAP is the ideal solution for monitoring full-duplex networks
utilized at more than 50 percent (100% when both sides are combined), but its
design requires that the analyzer be a specialized device with a dual-receive
capture interface that is capable of capturing the TAP’s output, providing
accurate timing, and recombining the data for analysis.
Table 1 (page 7)
list the advantages and disadvantages of three common
methods of accessing traffic from full-duplex networks for analysis, monitoring,
or forensics:
