Black Box TS250A, Руководство пользователя, Страница: 15 / 64

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview
15
rev. 1
Joining SPAN/mirror ports
If you have a primary switch and a failover switch, you can connect
both of them to an Aggregator TAP. Connect one of them to Link A
and the other to Link B. It does not matter whether the primary
switch is connected to Link A or Link B, and you do not need to know
which one is “live.” The Aggregator TAP joins the active and inactive
SPAN/mirror port session together and sends the result to the
analyzer. Regardless which switch is primary the Aggregator TAP
sends the SPAN/mirror port data from that switch to the analyzers.
Figure 3 Joining SPAN/mirror ports
When to use an Aggregator TAP
An Aggregator TAP makes a good compromise between the SPAN/
mirror port and full-duplex TAP options. It costs more than a full-
duplex TAP due to the added complexity and memory requirements
of its built-in buffer. But it does not require a specialized (and
potentially more expensive) analyzer with a dual-receive capture
interface. Like a full-duplex TAP, it is independent of the network,
making it immune to security threats.
An Aggregator TAP includes an internal buffer to mitigate the
bandwidth problem associated with converging both sides of the full-
duplex traffic from the network into one side of the full-duplex link to
the analyzer. The buffer is able to cache some spikes in network
utilization, but an Aggregator TAP drops packets when the bursts of
activity exceed its buffer capacity.