Viavi Apex Enterprise G3-APEX-ENT-32T, User Manual

Page: 210 / 380

Deploying probes in your network
210 GigaStor (23 Feb 2018) — Archive/Non-authoritative version
aggregators are designed to connect to a standard NIC, which allows them only
one side of the full duplex link to transmit data. A TAP, however, is designed to
connect to a dual-receive capture card. By sending data on both sides of the link
to the capture card, a TAP has double the transmission capability of the other
options, allowing it to mirror both sides of a fully saturated link with no dropped
packets and no possibility of degrading switch performance. And regardless of
utilization, SPAN/mirror ports filter out physical layer error packets, rendering
them invisible to your analyzer.
The most critical parts of your network are almost by definition those that see
the most traffic. If your network includes a business-critical link (for example, the
gigabit link that connects the customer service database to the core switch), a
TAP connected to a compatible probe or analyzer is the only way to ensure both
complete visibility and complete transparency to the network, regardless of how
saturated with traffic the link becomes.
Monitoring wireless traffic
If you place an Ethernet Probe on a switch to which a wireless access point
is connected, you will see the legitimate wireless station traffic connected
to your wired network. What you will not see is the 802.11 headers crucial to
understanding wireless-specific problems and security threats. You will also not
be able to see rogue access points, or illegitimate stations trying to associate
with access points. In short, to see all RF signals on the air at your site, you need
a wireless probe. In fact, you usually need more than one such probe to see all of
the access points and stations (legitimate or illicit) deployed on the site.
Deciding where to place probes in your network
Knowing where you want visibility has an impact on the number and type of
ports needed on your probe. It must be decided prior to purchasing so that the
proper number of TAPs and SFPs are included in the package that is shipped to
you.
To guarantee that every packet passing between every device on the network,
errors and all, is available to your analyzer is practically impossible on a network
with multiple switches. It would require placing a TAP on every link to each
switch. Fortunately, you need only place probes where the traffic is significant
enough to warrant the expense, and a lot of traffic is not that critical.
Ultimately, where to deploy probes depends on the design of your particular
network and where you require visibility. A probe only shows your analyzer the
data that is visible to that probe. The visibility of Ethernet Probe, for example, is
limited to what a particular switch's SPAN/mirror port can deliver. A specialized
hardware probe connected through a TAP sees only the traffic traversing that
link. If 100% coverage is important to you, install TAPs on all the high-speed
critical links in or near the core of your network, and probes plugged into the
SPAN/mirror ports of switches on the edge.
For example, placing TAPs on the full-duplex links that connect servers or server
farms to core switches will give you complete visibility into all traffic between
servers and their clients. Connecting additional half-duplex probe appliances
to SPAN/mirror ports at the edge of the network will let you focus in on any
segment or station on the network for detailed problem resolution.