For network IT managers that send data to monitoring tools, the concern about oversubscribed ports is a continual battle. You can’t always predict your network traffic, and as you probably know - problems arise at the worst times possible.
Some network TAP manufacturers promote buffering as an option to avoid oversubscription. But buffering is a bluff, at best it’s a band aid approach and at its' worst it’s a falsehood that introduces new latency and timing issues into the environment.
To guarantee (yes, I said guarantee) never oversubscribing ports, the foolproof method is to introduce filtering + aggregation.
Garland’s got it and is the only TAP vendor to offer this advanced functionality in both portable and rack mounted TAPs or a chassis solution.
In my recent blog, The Buffering Bluff on Aggregation TAPs, I went over how buffering creates a false sense of security. Here’s a quick recap:
Consider the following from Wireshark expert Andrew Brown in his 2014 Sharkfest presentation, Maximizing Packet Capture Performance:
- Packets take 1.48 seconds to send
- 20MB buffer takes - 2.5 seconds to write
- 512MB buffer takes - 46 seconds to write
That means that even a 1,000 MB buffer on a copper GB network TAP would reach capacity in just 89.8 seconds. Clearly, this can’t be considered an effective solution to traffic management challenges.
Set Utilization Rules and Alerts To Avoid Oversubscribed Ports
In our new filtering TAPs, the GUI /CLI remote management interface allows you to set up utilization alerts for each monitoring port. Most users start off with a standardized percentage such as 50%, the percentage can be changed for each monitoring port based on your network traffic.
Once an alert is triggered, you can remotely change TAP mode to breakout to avoid oversubscription, or you can set up filtering rules.
Flexible Filtering Options
- Filtering with Garland’s 1G Network TAPs allows for granular selection of network traffic at layers 2, 3, and 4.
- Filtering supports: MAC, VLAN ID, IP, DSCP, TCP, UDP, ICMP
With Garland’s 1G Portable Filtering TAP, you are able to filter and aggregate traffic to 1 or 2 monitoring tools. This filtering TAP is ideal for remote locations such as retail, banking, etc.
Garland’s 1U and 2U 1G Chassis, provides additional functionality with modular filtering TAPs.With port mapping (aka: filtering backplane) you can filter and aggregate up to four 1G links and send the data to a monitoring tool or analyzer and only use one port on the analyzer. This minimizes the number of monitoring ports required and saves budget.
Now that we’ve uncovered the truth about filtering + aggregation, and you know the falsehood of buffering, take a deeper dive on filtering and download our free eBook, Network TAPs 101: The Networking User Guide.
