Black Box TS250A, Руководство пользователя, Страница: 12 / 64

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview 12
rev. 1
channel. For more details, see “When to use a SPAN/mirror
port” on page 12.

Attaching a monitoring or analysis device to an Aggregator
TAP inserted into a full-duplex link.
As with a SPAN, the Aggregator TAP copies both sides of a
full-duplex link to the analyzer’s single receive channel. It uses
buffering which makes it somewhat better able to keep up
with higher traffic levels than a SPAN. For more details, see
“When to use an Aggregator TAP” on page 15 and “Choosing
an Aggregator TAP buffer size” on page 43.

Attaching a dual-receive monitoring or analysis device to a
full-duplex TAP inserted into a full-duplex link.
Dual-receive means that the network card on the analysis
device has two receive channels rather than the transmit and
receive channels associated with a standard full-duplex link.
For more details, see
“When to use a full-duplex TAP” on
page 17.
When to use a SPAN/mirror port
The advantage to using a SPAN/mirror port is its cost, as a SPAN/
mirror port is included for free with virtually every managed switch. A
SPAN/mirror port is also remotely configurable, allowing you to
change which ports are mirrored from the switch management
console.
Limitations of a SPAN/mirror port stem from the aggregation
necessary to merge full-duplex network traffic into a single receive
channel. For examples, when traffic levels on the network exceed the
output capability of the SPAN/mirror port, the switch is forced to
drop packets. Another reason that a SPAN/mirror port may not be the
right choice is because Layer 1 and 2 errors are not mirrored and
therefore never reach the analyzer. When performing network
troubleshooting, seeing these errors can be important.
When monitoring with a SPAN/mirror port on a switch, the switch
does three things:

Copies both the send and receive data channels

Reconstructs an integrated data stream from the two channels