<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

TAP Test: Do you need a Network TAP?

July 19, 2018

Young thoughtful handsome man in casual thinking over the ideas

Whether you are proactively designing a network for a new office or data center location, or looking to make changes to your current infrastructure, there are a lot of questions to ask during the initial design phase.
Planning for the visibility needed within the network to ensure that any monitoring or analysis tools get all of the traffic they need to successfully perform their job, is getting more difficult every day. Networks are getting more complex, with higher speeds carrying an increasingly unprecedented amount of data.  All of this complexity reinforces the need for a targeted visibility solution, using Network TAPs in place of SPAN ports as your access method for packet capture

Does Your Network Need:

  • Data with a usable time stamp
  • All data recorded - Good, Bad, Fragments.etc
  • Interframe Gap studies.
  • Real time data studies – VoIP, Video
  • Real time data reports –RPC, QoS
  • Jitter, Delay and Loss analysis
  • CALEA, Lawful and/or Litigation evidence
  • Visibility for security management
  • Data Leak recognition
  • Switch Load studies
  • Application management
  • Duplicate packet analysis
  • Duplicate path analysis

If you answer yes to any of these – You need to use a Network TAP instead of a SPAN port for your access method. Ensuring data integrity is the foundation of your network traffic analysis. Without ensuring that every bit, byte and packet® of traffic is captured from the link you are monitoring or recording, you can’t be sure that your analysis will be accurate.  

New Call-to-action

This especially comes into play for post breach analysis, where you are trying to find out what the intruders accessed in your network and how they accomplished the breach. If you rely on SPAN ports, you can’t be sure that your data will have a reliable time stamp, that all data was passed to your analyzer tool, and even more importantly, your findings and report won’t be permissible in court.  Best practice states to use a Network TAP!


[If I haven’t convinced you to use Network TAPs yet, download my whitepaper, TAP vs SPAN: Real Network Visualization Considerations for Professionals, today to learn more about this vital technology.]

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations
Contact Us

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES