Visibility Solutions

Garland Technology is committed to educating the benefits of having a strong foundation of network visibility and access. By providing this insight we protect the security of data across your network and beyond.

Resources

Garland Technology's resource library offers free use of white papers, eBooks, use cases, infographics, data sheets, video demos and more.

Blog

The TAP into Technology blog provides the latest news and insights on network access and visibility, including: network security, network monitoring and appliance connectivity and guest blogs from Industry experts and technology partners

Partners

Our extensive technology partnership ecosystem solves critical problems when it comes to network security, monitoring, application analysis, forensics and packet inspection.

Company

Garland Technology is dedicated to high standards in quality and reliability, while delivering the greatest economical solutions for enterprise, service providers, and government agencies worldwide.

Contact

Whether you are ready to make a network TAP your foundation of visibility or just have questions, please contact us. Ask us about the Garland Difference!

Blogheader image

TAP Into Technology

Leading the Way in Network Technology

The Buffering Bluff on Aggregation TAPs

Posted by Chris Bihary | 12/15/16 8:00 AM

In a world of shrinking IT budgets, many are turning to network aggregating TAPs to reduce costs within their security and network monitoring programs. Because aggregating TAPs integrate multiple traffic flows into a single stream, IT can then purchase monitoring and security solutions with less port density per appliance.

However, there is a tradeoff. IT must ensure that the connected devices don’t become overwhelmed by traffic as network utilization rates increase and spikes occur. 

To combat short term bandwidth issues, some vendors have added buffering to their TAPs in an attempt to capture – and later transmit – any data that the monitoring port can’t handle in real time. Unfortunately, this is band aid approach and doesn’t actually solve the problem. Worse, it introduces new latency and timing issues into the environment.

If buffering is not the solution, what is?

Creating a False Sense of Security

Even if you are willing to disregard latency and timing problems, the typical buffering solution doesn’t provide enough relief to ensure that packets won’t be dropped during a heavy traffic spike. 

Consider the following from Wireshark expert Andrew Brown in his 2014 Sharkfest presentation, Maximizing Packet Capture Performance:  

  • Packets take 1.48 seconds to send
  • 20MB buffer takes - 2.5 seconds to write
  • 512MB buffer takes - 46 seconds to write

That means that even a 1,000 MB buffer on a copper GB network TAP would reach capacity in just 89.8 seconds. Clearly, this can’t be considered an effective solution to traffic management challenges.

Download Maximizing Visibility!

Skip the Workarounds – Rely on Best Practice Connectivity Approaches

Today, escalating network usage and traffic spikes are a reality that every network engineer must plan for. When designing a network connectivity architecture, there are several best practice strategies that allow you to effectively utilize aggregation TAPs without compromising the integrity of your security and network monitoring programs:   

  • Switch Aggregation TAPs to Breakout T­AP Mode: When traffic spikes, the best insurance against packet loss is to simply reconfigure the network TAP to breakout TAP mode, which breakouts the transmit (Tx) and receive (Rx) traffic to two separate monitoring ports. 
  • Reduce your Aggregation Group: Today’s engineers don’t just use aggregators to integrate east-west and west-east traffic into a single stream. They also use them to collect traffic data from up to four network TAPs inserted at different points in the network and send them to a single monitoring port on a device. When network utilization rates increase, administrators can simply limit the number of traffic streams that are being aggregated at one time.   
  • Apply Traffic Filters: While -gen firewalls need to see every bit, byte and packet®, other devices (VoIP monitoring tools, lawful intercept devices, etc.) may not need to analyze 100% of the traffic flow. With an advanced filtering solution, you can granularly separate and direct layer 2, 3 and 4 data to specific appliances depending on their exact needs. This lets you reduce port requirements, support more devices from a single aggregating TAP and enrich results with data from multiple points in the network.
Filter network TAPs by Garland Tech prevent over subscribed ports

Automate the Process to Ensure Success

At Garland, we understand that having to manually monitor traffic levels and adjust network TAP settings is not an efficient way to spend your day. Therefore, we added a management controller to our 1U and 2U chassis to provide the flexibility you need to mitigate risk and control traffic spikes in a way that best supports your unique goals. Now, you can set up an SNMP or Syslog alert to notify you when specific monitoring ports hit their 80% utilization rate, allowing you to take corrective action before packet loss can occur.

Aggregation TAPs are critical to creating a strong, cost-effective network connectivity program.  However, they are not all created equal. To learn more on the advanced functionality of aggregation and filtering, download our white paper, Maximizing Visibility.

Topics: Network TAPs, Network Management

Written by Chris Bihary

Chris Bihary has been in the network performance industry for over 20 years. Bihary has established collaborative partnerships with technology companies to complement product performance through the integration of network test access points. Previously, Bihary was Managing Partner at Network Critical.

Sign up for blog updates