In a world of shrinking IT budgets, many are turning to network aggregating TAPs to reduce costs within their security and network monitoring programs. Because aggregating TAPs integrate multiple traffic flows into a single stream, IT can then purchase monitoring and security solutions with less port density per appliance.
However, there is a tradeoff. IT must ensure that the connected devices don’t become overwhelmed by traffic as network utilization rates increase and spikes occur.
To combat short term bandwidth issues, some vendors have added buffering to their TAPs in an attempt to capture – and later transmit – any data that the monitoring port can’t handle in real time. Unfortunately, this is band aid approach and doesn’t actually solve the problem. Worse, it introduces new latency and timing issues into the environment.
If buffering is not the solution, what is?
Even if you are willing to disregard latency and timing problems, the typical buffering solution doesn’t provide enough relief to ensure that packets won’t be dropped during a heavy traffic spike.
Consider the following from Wireshark expert Andrew Brown in his recent Sharkfest presentation, Maximizing Packet Capture Performance:
That means that even a 1,000 MB buffer on a copper GB network TAP would reach capacity in just 89.8 seconds. Clearly, this can’t be considered an effective solution to traffic management challenges.
Today, escalating network usage and traffic spikes are a reality that every network engineer must plan for. When designing a network connectivity architecture, there are several best practice strategies that allow you to effectively utilize aggregation TAPs without compromising the integrity of your security and network monitoring programs:
At Garland, we understand that having to manually monitor traffic levels and adjust network TAP settings is not an efficient way to spend your day. Therefore, we added a management controller to our 1U and 2U chassis to provide the flexibility you need to mitigate risk and control traffic spikes in a way that best supports your unique goals. Now, you can set up an SNMP or Syslog alert to notify you when specific monitoring ports hit their 80% utilization rate, allowing you to take corrective action before packet loss can occur.
Aggregation TAPs are critical to creating a strong, cost-effective network connectivity program. However, they are not all created equal. To learn more on the advanced functionality of aggregation and filtering, download our white paper, Maximizing Visibility.
Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!
