Blogheader image.png

TAP Into Technology

Leading the Way in Network Technology

When A Simple SPAN Port Is Enough

Posted by Timothy Schmidt | 9/11/18 8:00 AM

There are situations when a SPAN port perfectly suffices.  And when SPAN ports are being used, you likely need a way to aggregate a few SPAN lines together and send that combined network traffic out to one or more sets of tools or appliances. When these situations arise, think simplicity.

Think about using one set of network tools rather than having a unique set of tools for each SPAN. Or worse, having to rotate the tools to each SPAN port.




When we are working with a SPAN input, we do not need to worry about failure of the device attached to the SPAN port because SPAN is simply a copy of the network traffic. If there is a failure at the end of the SPAN line, the link is not affected. Knowing this, we can take SPAN inputs directly to our Advanced Aggregators without introducing a point of failure to the network traffic, and then filter, aggregate and load balance, prior to distributing the traffic out one or more tools.


Six SPANs connected to an Advanced Aggregator feeding two Appliances

You can aggregate all the traffic and send it out to the network tools, or you can send some of the traffic out to one monitor port and a different set of the traffic out to the other monitor port.


Traffic distribution
Two SPANs Connected to 6 Tools or Appliances


Now we're changing the scenario to two SPANs that we want to aggregate together. That leaves enough ports available for monitoring up to six tools or appliances.


New Call-to-action


Below we see a scenario where we have 6 SPANs (or more if necessary). We are still connecting to an Advanced Aggregator, so we can distribute the traffic from the 6 SPANs to more monitoring devices. The Monitoring devices can be 1G devices and the Network ports can be 10G.


Connecting to an Advanced Aggregator allows more flexibility


The appliances can be set up to share the traffic load by "load balancing" and even filtering the data. This way, only the traffic of interest is sent out to the appliances and you can minimize the possibility of oversubscribing the 1G monitor ports. All the ports on the Advanced Aggregator are configurable as a Network Port or a Monitor Port, and the speed can be 1G or 10G. So, to use a cliché, the possibilities are endless!

Topics: Network Management, TAPs vs SPAN

Written by Timothy Schmidt

Timothy is a Territory Sales Manager at Garland Technology. Timothy leads in Garland's mission in educating all organizations and individuals on the benefits of having a strong foundation of network visibility and access.