Black Box TS250A, Руководство пользователя, Страница: 16 / 64

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview 16
rev. 1
N
OTE
: TAP B
UFFER
The role of the buffer is to absorb traffic spikes of over 50%
full-duplex bandwidth saturation (100% with both sides
combined), because the analyzer’s single-receive interface
cannot receive the traffic fast enough to keep up at line rate.
For more details about the Aggregator TAP’s buffer, see
“Choosing an Aggregator TAP buffer size” on page 43.
An Aggregator TAP is ideally suited to work with an analysis device
with a standard, single-receive capture interface or NIC. This means
that a laptop or a standard system can be deployed as an analyzer
rather than the more expensive specialized analyzers or appliances
that are designed to accept full duplex traffic through a dual-receive
capture interface.
Just like a SPAN/mirror port, an Aggregator TAP is ideal for a lightly
used network that occasionally has utilization peaks above the capture
capacity of the analyzer. Unlike a SPAN/mirror port, the Aggregator
TAP will forward Layer 1 and 2 errors to the analysis device.
Another advantage the Aggregator TAP has over a SPAN/mirror port
session is its internal memory buffer. The memory buffer provides
limited protection against packet loss, and if the network utilization
does not regularly exceed the capacity of the analyzer’s capture card,
an Aggregator TAP may be the right choice.
The appropriate solution for capturing full-duplex data for analysis
depends on the rates of traffic you must monitor, and what level of
visibility you require. When monitoring a lightly-used network, using
a SPAN/mirror port or Aggregator TAP to supply an analysis device
with a standard NIC (i.e., single-receive) interface can be an
economical choice. The Aggregator TAP can provide protection
against packet loss, but if usage spikes exceed its buffer capacity
before the link to the analyzer can catch up, the Aggregator TAP
drops packets.
To monitor a critical, heavily utilized full-duplex link, a full-duplex
TAP is the only alternative. Monitoring a full-duplex connection using
a full-duplex TAP and an analyzer with a dual-receive capture
interface guarantees complete, full-duplex capture for monitoring,
analysis, and intrusion detection regardless of bandwidth saturation.
See
“Aggregator TAPs” on page 41 for full details about the TAPs.