Black Box TS250A, Руководство пользователя, Страница: 11 / 64

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview
11
rev. 1
combined), but its design requires that the analyzer be a specialized
device with a dual-receive capture interface that is capable of
capturing the TAP’s output, providing accurate timing, and
recombining the data for analysis.
Table 2 list the advantages and disadvantages of three common
methods of accessing traffic from full-duplex networks for analysis,
monitoring, or forensics:
Whether you are monitoring a network for security threats or
capturing and decoding packets while troubleshooting, you need a
reliable way to see the network traffic. The appropriate TAP for
capturing full-duplex data for analysis depends on the rates of traffic
you must monitor, and what level of visibility you require.

Attaching a monitoring or analysis device to a switch’s
analyzer port (SPAN/mirror port) to monitor a full-duplex
link.
Because a SPAN/mirror port is a send-only simplex stream of
data there is a potential bottleneck when trying to mirror both
sides of a full-duplex link to the analyzer’s single receive
Table 2 Span vs Aggregator vs Full-duplex TAPs
Aggregator SPAN/Mirror Full-Duplex
Requires power
   1
May drop packets
 2 
Uses single-receive capture card
 
Uses internal buffer to mitigate traffic spikes

Suitable for networks with light to moderate
traffic with occasional spikes

Passes OSI Layer 1 & 2 errors
 
Not Addressable (cannot be hacked)
 
Requires dual-receive capture card

Ideal for heavy traffic/critical networks

Suitable for networks with light to moderate
traffic

Remotely configurable

1. The optical TAPs do not require power, but the copper TAPs do.
2. Although an Aggregator TAP has an internal buffer that mitigates spikes in traffic, when the buffer itself is full,
the new packets are dropped until the output of the buffer can catch up.