Today I'm going to review another way that a network TAP can be used when trying to get access to network traffic. The SPAN mode is a unique mode for a TAP that takes the SPAN or mirrored output from a network switch or router into the A port and can replicate all the traffic it receives and send it out ports B, and/or C and/or D of the TAP.
When would you use the SPAN port on a TAP?
Figure 1: SPAN Port Sends a Mirrored Output
The SPAN/Mirrored output of the switch is the aggregation of the “send” and “receive” traffic of the link as illustrated above.
An important observation shows us that, unlike the Breakout or Aggregation TAP modes, there is no need to worry about the network TAP being a point of failure. The link itself does not run through the TAP; only the copy of the link’s traffic is sent to the TAP.
There are many situations when there are not enough SPAN/Mirrored ports available on a router or switch to allow access to all of the monitoring tools that need to see the traffic of the Link, so introducing a TAP set to SPAN/Regeneration mode provides a way to distribute a Link’s traffic to up to three network tools as illustrated in Figure 2.
Figure 2: SPAN output of Link 1 to TAP port A. TAP replicated and passes the SPAN traffic out to Ports B, C and D of the TAP
Figure 2: SPAN/Mirrored Output Regenerates to Send to Appliances
When planning network access using SPAN/Mirrored traffic from a router or switch, keep in mind that the router or switch’s job is to be a router or switch first, and if they start to get really busy, they will forego servicing the SPAN ports so that they can keep up with their primary function.
So, if you need to monitor all of the network traffic without exception, then you need to use a Breakout or Aggregation TAP to provide access rather than a SPAN/Mirror switch.
Well, that’s about all that is pertinent about a SPAN/Regeneration TAP. There are times when they are simple solution.
Garland Technology's, The 101 Series is an educational series on how network TAPs work and the different functions they provide to the overall network design for access and visibility.
Next time, we will review the TAPs that can provide Media Conversion. They provide a way to convert Network Fiber links to Copper on the monitor side of the TAP. Until then read this great white paper on the differences of TAP vs. SPAN.