Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 2: Why choose a TAP or SPAN port 7
Table 1. Methods of accessing traffic
Aggregator
SPAN/Mirror
Full-Duplex
Requires power
X
X
X
1
Better
2
protection
against dropped
packets
X
X
Uses single-receive
capture card
X
X
Uses internal buffer
to mitigate traffic
spikes
X
3
Suitable for
networks with light
to moderate traffic
with occasional
spikes
X
Passes OSI Layer 1
& 2 errors
X
X
Not Addressable
(cannot be hacked)
X
X
Requires dual-
receive capture
card
X
Ideal for heavy
traffic/critical
networks
X
Suitable for
networks with light
to moderate traffic
X
Remotely
configurable
X
1.
The Optical TAP does not require power, but the Copper TAP does.
2.
Better protection against dropping packets than SPAN/mirror.
3.
Although the Aggregator TAP has an internal buffer that mitigates spikes in traffic, when the
buffer itself is full, the new packets are dropped until the output of the buffer can catch up.
Whether you are monitoring a network for security threats or capturing and
decoding packets while troubleshooting, you need a reliable way to see the
network traffic. The appropriate TAP for capturing full-duplex data for analysis
depends on the rates of traffic you must monitor, and what level of visibility you
require.
♦
Attaching a monitoring or analysis device to a switch’s analyzer port
(SPAN/mirror port) to monitor a full-duplex link.
Because a SPAN/mirror port is a send-only simplex stream of data there
is a potential bottleneck when trying to mirror both sides of a full-duplex
