In our 101 network TAP series, we have explained the functionality of the various network TAPs that are available to gain access to the traffic that is typically found in a network. We have reviewed passive fiber TAPs, copper network TAPs, aggregation TAPs, SPAN/regeneration TAPs and the bypass TAP.
Now we want to review the ultimate way to optimize your visibility fabric – deploying advanced data filtering with packet broker functionality in a TAP.
A network TAP will copy all of your data – every bit, byte and packet on your network. But sometimes your tools don’t need to see everything. Your VoIP or Wireshark only needs to see the traffic required to do its job. In this case we need to add the additional technology of filtering. When we are not interested in all the traffic that is going through the link, we can filter out what is not required by the tool – this ensures we will not oversubscribe the monitor ports.
This scenario (below) shows four 1G links with a filter applied and then aggregated together and sent out port D on TAP four to the monitoring or security tool.
Port mapping (aka: filtering backplane) on the new XtraTAP: All-In-1 Chassis is an important feature because it allows you to aggregate low traffic links such as 1G VoIP links together. You can aggregate up to four 1G links to send to a VoIP analyzer and use only 1 port on the analyzer. This benefit minimizes of the number of monitor ports required on the monitoring tools and appliances.
Of course, when aggregating the traffic of multiple links there is the possibility of oversubscribing the TAP’s monitoring ports. To eliminate the possibility of oversubscribing we need to filter out the traffic that the monitoring appliances are not interested in, we do this with rule-based filters (see below). We also have the option to not apply a filter by sending all the data to a critical appliance like an intrusion detection system (IDS).
The XtraTAP: All-In-1 provides the capability of filtering network traffic at Layers 2, 3 and 4 of a packet. Providing the monitoring tools with only the traffic that they are interested in and creating efficiency to do only the processing they are designed for.
So, being able to aggregate the links together is good and then filtering out the traffic that the monitoring appliances are not interested in is better.
Today's blog is all about the filtering capabilities in our new chassis system. However, this new 1G wonder box can do it all because it supports all of Garland's modular TAPs, including: copper network TAPs, aggregation TAPs, SPAN/regeneration TAPs and bypass TAPs.
Garland Technology's, The 101 Series is an educational series on how network TAPs work and the different functions they provide to the overall network design for access and visibility.
Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!