<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
Skip to content

Visibility Solutions

Garland Technology is committed to educating the benefits of having a strong foundation of network visibility and access. By providing this insight we protect the security of data across your network and beyond.

Resources

Garland Technology's resource library offers free use of white papers, eBooks, use cases, infographics, data sheets, video demos and more.

Blog

The TAP into Technology blog provides the latest news and insights on network access and visibility, including: network security, network monitoring and appliance connectivity and guest blogs from Industry experts and technology partners

Partners

Our extensive technology partnership ecosystem solves critical problems when it comes to network security, monitoring, application analysis, forensics and packet inspection.

Company

Garland Technology is dedicated to high standards in quality and reliability, while delivering the greatest economical solutions for enterprise, service providers, and government agencies worldwide.

Contact

Whether you are ready to make a network TAP your foundation of visibility or just have questions, please contact us. Ask us about the Garland Difference!

The 101 Series: Network Packet Brokers

Understanding and maintain control of your network is a constant, uphill battle. With the increase in network virtualization, BYOD, and growing number of security threats, network monitoring is more important than ever.  It’s well documented that the foundation of any good visibility fabric comes from using network Test Access Points (TAPs), but then where does all that TAP’d traffic go? The answer should be, to a Network Packet Broker.

This is the first blog in a three-part series highlighting the Network Packet Broker

Blog 1: What is a Network Packet Broker?

Blog 2: Understanding NPB advanced features

Blog 3: Selecting the right NPB for your network


Network Packet Broker’s (NPBs) are devices that do just what the name suggests, they “broker” incoming network traffic to any number of security, application performance monitoring, or network forensic tools.The need to “broker” packets before they’re sent to tools comes from 2 major driving forces.  First, the throughput of tools is limited, second, every tool requires a different subset of traffic to maximize performance.

NPBs are designed to deliver only the traffic of interest required by any specific tool. NPBs achieve this by using a variety of filtering options that will be explained in detail in the next blog in this series. NPBs act as the man-in-the-middle between TAP/SPAN ports and the tool itself and should be designed with 4 different deployment scenarios in mind:

1)   Broker traffic from a single TAP port to a single tool

In this application the most important function of the NPB is its filtering capability.  Most tools currently deployed handle up to 10Gbps of traffic at any given time. If the incoming TAP traffic is 40Gbps, the traffic needs to be filtered by a factor of 4.  The NPB needs to ensure the traffic is filtered adequately to meet this limitation while providing every packet the tool needs to do its job.

Single TAP port to a single tool

2)   Broker traffic from multiple TAP ports to a single tool

This application builds on the previous, but now the NPB needs to support aggregation.  Aggregation allows the user to setup single filters that will be applied to all incoming traffic streams, reducing the setup time/complexity of the device. Aggregation also ensures the tool receives traffic from multiple streams.

Multiple TAP ports to a single tool


>> Download Now: Aggregation [Free whitepaper]


3)   Broker traffic from a single TAP port to multiple tools

This application builds on the first, however, the NPB now needs to be able to replicate and/or load balance traffic. The traffic needs to be replicated/mirrored/copied to ensure each tool has access to any necessary packets.  To properly handle this application, the NPB must also support egress filtering, to allow unique filters criteria for each different tool. If multiple tools require the same filtered traffic, the NPB must also support load balancing and options on how to load balance.  Well designed NPB’s should support configurable hash-based load balancing, round-robin and weighted round-robin options.

Single TAP port to multiple tools

 

4)   Broker Traffic from multiple TAP ports to multiple tools

The final application builds on the previous three and uses filtering, aggregation and load balancing to guarantee each tool operates at its maximum efficiency.

Multiple TAP ports to multiple tools


If TAPs are the foundation, NPBs are the load bearing structural element of a well-designed visibility fabric.  They offer many advanced features to ensure each tool operates to its full potential, by individually tailoring each egress stream to meet the needs of any tool.  Subsequent blogs in this series will dive into much greater detail on these advanced features and how to select the right NPB for your network.

Network Aggregation maximizes network visibility and optimize network packet broker ports

Written by Jerry Dillard

Jerry Dillard, CTO and Co-founder of Garland Technology, leverages over two decades in design and engineering to ensure maximum performance within today’s network environments. Dillard, the inventor of the Bypass TAP, continues to innovate network visibility solutions worldwide.

Authors

Topics

Sign Up for Blog Updates