logix - the case for network taps

Windows of The Arab Institute, Paris, designed as an iris to react to the light.

The case for Taps

Taps provide a "Test Access Port" for analyzing high-speed networks in half or full duplex mode. When operating high-speed, high-capacity, data communications systems it is often necessary to monitor and analyze traffic with an absolute minimum disturbance to the data stream. Taps provide inexpensive, permanent access ports throughout the network, enabling monitoring and analysis without interrupting transmission.

Taps Advantages
Tap technology supports network monitoring and intrusion detection for almost any network configuration, including GigaBit SX, LX or ZX; ATM, DS3, T1 and Fast Ethernet copper. In addition, NetOptics just introduced the GigaBit TX to SX Tap, the market's first copper-to-fiber tap. Taps are extremely reliable, featuring passive-link integrity enabling the network to operate at a continuous flow. These rack-mountable taps feature easy installation and broad compatibility: network managers can simply plug in the network cables to communicate with all major analyzer manufacturers' products including Network Associates' Sniffer®, Agilent's Internet Advisor & Cisco's SwitchProbe products, to name just a few.

Taps Versus Span Port Connection
To enable monitoring and intrusion detection, most of the major switch vendors now support span (or mirror) ports on their switches. This allows the traffic to be sent to an analyzer port as well as the original designated port.

A Span Port solution has three major drawbacks.

First, it puts an increased load onto the switch that often increases CPU or memory requirements.
Second, when packets are sent to a span port, most vendors' switches remove low level (Layer 1, select Layer 2) errors from the stream of data. This makes low level troubleshooting impossible.
Third, if the link is a full duplex link running at full line rate, then to mirror this data would require a span port running at full line rate to get both directions of traffic. Unless a non-blocking switch is being used, large amounts of data could be lost because span port traffic is a low priority.

The tap solution for network monitoring and intrusion detection utilizes passive fiber or copper splitter taps on the main network links. This solution mitigates the trouble and expense associated with the three drawbacks mentioned above.

Taps Versus In-Line Connection
Another common solution for monitoring and intrusion detection is to attach the analyzer in-line.
An in-line solution has two major drawbacks:

First, because it is not cost effective to leave an analyzer in-line, network managers must break a connection whenever they need to monitor.
Second, because the analyzer is not passive, attaching an analyzer in-line introduces a point of failure into the network.

The permanent, passive tap solution eliminates the risk and inefficiency associated with monitoring with an in-line analyzer connection.

Flexibility
Taps provide network managers with the flexibility to monitor all aspects of the network 24/7. As network security and reliability continue to grow in importance, Taps are an integral solution for any network.