Visibility Solutions

Garland Technology is committed to educating the benefits of having a strong foundation of network visibility and access. By providing this insight we protect the security of data across your network and beyond.


Garland Technology's resource library offers free use of white papers, eBooks, use cases, infographics, data sheets, video demos and more.


The TAP into Technology blog provides the latest news and insights on network access and visibility, including: network security, network monitoring and appliance connectivity and guest blogs from Industry experts and technology partners


Our extensive technology partnership ecosystem solves critical problems when it comes to network security, monitoring, application analysis, forensics and packet inspection.


Garland Technology is dedicated to high standards in quality and reliability, while delivering the greatest economical solutions for enterprise, service providers, and government agencies worldwide.


Whether you are ready to make a network TAP your foundation of visibility or just have questions, please contact us. Ask us about the Garland Difference!

Blogheader image

TAP Into Technology

Leading the Way in Network Technology

When A Simple SPAN Port Is Enough

Posted by Steve Harris | 9/11/18 8:00 AM

The two most common ways to access and replicate data within your network are TAP and SPAN technology. A Test Access Point (TAP) is a hardware device that copies all of your network data. SPAN or Switch Port Analyzer are mirroring ports within a switch that copies specific data.

Network TAPs are always an industry best practice but in a few specific situations when a SPAN port suffices. When monitoring products are looking for low bandwidth application layer events like “conversation or connection analysis,” “application flows,” and applications where real time and knowing real delta times are not important. SPAN could also be used in a remote location that doesn’t justify a permanent deployment, offering temporary access for troubleshooting. 

In these low throughput specific situations when a SPAN port suffices, you likely need a way to aggregate a few SPAN lines together and send that combined network traffic out to one or more sets of tools or appliances. When these situations arise, think simplicity.

Think about using one set of network tools rather than having a unique set of tools for each SPAN. Or worse, having to rotate the tools to each SPAN port.




When we are working with a SPAN input, we do not need to worry about failure of the device attached to the SPAN port because SPAN is simply a copy of the network traffic. If there is a failure at the end of the SPAN line, the link is not affected. Knowing this, we can take SPAN inputs directly to our Advanced Aggregators without introducing a point of failure to the network traffic, and then filter, aggregate and load balance, prior to distributing the traffic out one or more tools.


Six SPANs connected to an Advanced Aggregator feeding two Appliances

You can aggregate all the traffic and send it out to the network tools, or you can send some of the traffic out to one monitor port and a different set of the traffic out to the other monitor port.


Traffic distribution
Two SPANs Connected to 6 Tools or Appliances


Now we're changing the scenario to two SPANs that we want to aggregate together. That leaves enough ports available for monitoring up to six tools or appliances.


Download Now: TAP vs SPAN - Network Visualization Considerations for Professionals [Free whitepaper]


Below we see a scenario where we have 6 SPANs (or more if necessary). We are still connecting to an Advanced Aggregator, so we can distribute the traffic from the 6 SPANs to more monitoring devices. The Monitoring devices can be 1G devices and the Network ports can be 10G.


Connecting to an Advanced Aggregator allows more flexibility


The appliances can be set up to share the traffic load by "load balancing" and even filtering the data. This way, only the traffic of interest is sent out to the appliances and you can minimize the possibility of oversubscribing the 1G monitor ports. All the ports on the Advanced Aggregator are configurable as a Network Port or a Monitor Port, and the speed can be 1G or 10G. So, to use a cliché, the possibilities are endless.

Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!

TAP versus SPAN, ways to improve your tool performance and data quality

Topics: Network Management, TAPs vs SPAN

Written by Steve Harris

As Regional Sales Manager, Northeast for Garland Technology, Steve is responsible for developing and implementing end user and partner strategies.

Sign up for blog updates