With the rise in the number of monitoring tools enterprises are using to analyze their network traffic, a new problem has arisen; how will you get network traffic to multiple out-of-band monitoring tools? Garland Technology recognized the need for a Network TAP that would allow traffic from a single network link to be sent to multiple monitoring appliances to analyze the network.
Garland is excited to announce the launch of two new products to our comprehensive line of Copper and Fiber Network TAPs, the RegenTAP: 1x5 and RegenTAP: Dual Breakout, both for 10G networks.
Regeneration TAPs are used to capture 100% full duplex traffic that can then be sent to multiple monitoring appliances to analyze your network. Garland’s RegenTAP: 1x5 provides up to five complete copies of data from a single link to monitoring or security devices in your network. This is an ideal application for companies with multiple devices that need to guarantee 100% packet visibility, but doesn’t require the advanced filtering and aggregation that would be provided by Network Packet Brokers.

In this example, we see traffic going to both a SIEM and an IDS. This leaves three full sets of traffic for future expansion. The RegenTAP: 1x5 is a cost-effective solution that can solve your network access problem today and as your network grows, providing excellent ROI compared to alternative solutions.
A multifaceted device, Garland’s RegenTAP: Dual Breakout also provides multiple complete copies of data to monitoring and security devices in your network. The Dual Breakout houses two TAPs in one appliance, while providing tap ‘breakout’ copies of data, this product also provides aggregation copies for additional applications. This means that multiple links, or one redundant connection can be tapped using one device, saving space and resources in the data center.

In this use case, full line-rate traffic is being sent to an IDS that has a 4 port NIC. A network analyze with fewer ports can receive an aggregated copy of the traffic.
There has recently been a rise in the use of direct connect cables being used to build out data center and network infrastructure. Direct connect cables are considered an active cable, meaning the only way the cable can work is to be powered, and that traditional failsafe technology cannot be used. To solve this issue, the RegenTAP: Dual Breakout comes with pre-configured ports that are locked down, ensuring that router traffic will always go to the switch, and the switch traffic will always go to the router. Additionally, redundant power supplies guarantee that the TAP will always be powered and eliminating the chances of network downtime.
While many copper ethernet links remain at 1G, for companies that have migrated to 10G Copper Networks, the RegenTAP: Dual Breakout also provides the option to use copper transceivers to tap any 10G copper links and send multiple copies of that traffic to monitoring tools for analysis.
Garland Technology’s best-in-class Network TAP and purpose-built Packet Broker solutions provide an innovative, industry leading 360° view for modern visibility fabrics. Our unique adaptability makes it easy for you to help save your customers' budget by deploying what they need, when they need it, and by adding value to existing infrastructure.
Looking to add a visibility to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.
If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.
If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.
While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.
Some of you may have noticed a flaw in the logic behind this solution! You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.
Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.
Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.
Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.