<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

Don’t Choose The Wrong Network TAP

December 26, 2019

Team of technicians working together on servers at the data centre

If you’ve previously read the Garland Technology blog, you know the importance that network TAPs have with regard to guaranteeing your network security and visibility. These devices provide a complete copy of traffic, passing data to your critical monitoring tools and applications.

It’s essential to understand that not all network TAPs are made the same. From speed and materials to functional characteristics, do you know which TAP you need to protect your network?

To determine which TAP best suits your network, you must decipher the type of traffic that you need to capture, followed by the speed. Are you looking to TAP 10/100/1000M Copper or 1/10/40/100G Fiber?

But there’s more to consider. There are a number of different TAPs that have varying functional capabilities.

Filtering TAP

A new type of network TAP, filtering TAPs are an especially valuable device in the 10G and 40G environments due to the cost of test equipment in this space. Some TAPs have the ability to utilize more commonly accessible 1G analysis and monitoring tools in 10G networks. To avoid dropping packets and ensure complete data capture, Garland's XtraTAP: All-in-1 has advanced filtering capabilities that selectively pass data to the 1G port based on your set criteria – from application to VLAN ID or other factors.

>> Download Now: Network TAPs 101 [Free eBook]

At greater speeds, analyzing your network traffic using the "capture and decode" method is virtually impossible. Filtering access is the best way to analyze your business-critical traffic. An XtraTAP is an impactful component of any strategic effort to monitor specific, essential network metrics, like frame errors and corrupted frames in IPv6.

Keep in mind that any network TAP with filtering capabilities must meet specific criteria in order to be a true asset to your complete network design. These elements include:

  • Easy setup and management

  • A simple user interface

  • Collecting Data from a TAP, not a SPAN/Mirrored Port


Bypass TAPs

Bypass TAPs are powerful access solutions used with active, inline security applications such as next-gen firewalls and intrusion prevention systems. All Garland EdgeSafe™: Bypass Network TAPs come with network failsafe technology, which ensures that during failsafe, inline appliances still receive packets, by recognizing power outages and automatically closing the relay circuitry in less than 8 milliseconds.

Bypass TAPs also include a heartbeat system, which monitors the normal operation of your network or synchronizes other parts of a system.

  • Heartbeat packets are sent out of each monitoring port

  • If heartbeat packets aren’t received from either direction, Bypass mode kicks in switching the inline appliance to out-of-band

  • Heartbeat packets are never sent out onto the live network

Virtual TAPs

With organizations becoming more dependent on virtual computing, IT professionals need a solution to eliminate blind spots from these virtual environments.  Virtual or Cloud TAPs are a new software solution designed to address these challenges by providing for complete visibility for east-west and inter-VM traffic.

By combining physical TAPs with a Cloud TAP like Garland Prisms, IT teams can guarantee that they are seeing every bit, byte and packet across their network.

Knowing which network TAP is best for your organization depends on your unique needs. Be strategic about designing your network and proactive about identifying changes in the future. With the right TAP and a foolproof network, your business is better positioned for success.

Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!

Network TAPS 101 Basics for IT Security engineers

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES