Viavi 10/100 Copper nTAP, Руководство пользователя

Страница: 12 / 30

Choosing between a SPAN, Aggregator, or full-duplex TAP
12 10/100 Copper nTAP (7 Feb 2018) — Archive/Non-authoritative version
Figure 3: Joining SPAN/mirror ports
When to use the Aggregator TAP
The Aggregator TAP offers a compromise between the SPAN/mirror port and
full-duplex TAP options. It costs more than a full-duplex TAP due to the added
complexity and memory requirements of its built-in buffer.
The Aggregator TAP does not require a specialized (and potentially more
expensive) analyzer with a dual-receive capture interface. Like a full-duplex TAP,
it is independent of the network, making it immune to security threats.
The Aggregator TAP includes an internal buffer to mitigate the bandwidth
problem associated with converging both sides of the full-duplex traffic from the
network into one side of the full-duplex link to the analyzer. The buffer is able to
cache some spikes in network utilization, but the Aggregator TAP drops packets
when the bursts of activity exceed its buffer capacity.
The Aggregator TAP is ideally suited to work with an analysis device with a
standard, single-receive capture interface or NIC. This means that a laptop or a
standard system can be deployed as an analyzer rather than the more expensive
specialized analyzers or appliances that are designed to accept full duplex traffic
through a dual-receive capture interface.
Just like a SPAN/mirror port, the Aggregator TAP is ideal for a lightly used
network that occasionally has utilization peaks above the capture capacity of the
analyzer. Unlike a SPAN/mirror port, the Aggregator TAP will forward Layer 1 and
2 errors to the analysis device.
Another advantage the Aggregator TAP has over a SPAN/mirror port session is its
internal memory buffer. The memory buffer provides limited protection against
packet loss, and if the network utilization does not regularly exceed the capacity
of the analyzer’s capture card, an Aggregator TAP may be the right choice.
The appropriate solution for capturing full-duplex data for analysis depends
on the rates of traffic you must monitor, and what level of visibility you
require. When monitoring a lightly-used network, using a SPAN/mirror port or
Aggregator TAP to supply an analysis device with a standard NIC (i.e., single-
receive) interface can be an economical choice. The Aggregator TAP can provide