The Buffering Bluff on Aggregation TAPs

In a world of shrinking IT budgets, many are turning to network aggregating TAPs to reduce costs within their security and network monitoring programs. Because aggregating TAPs integrate multiple traffic flows into a single stream, IT can then purchase monitoring and security solutions with less port density per appliance.

However, there is a tradeoff. IT must ensure that the connected devices don’t become overwhelmed by traffic as network utilization rates increase and spikes occur. 

To combat short term bandwidth issues, some vendors have added buffering to their TAPs in an attempt to capture – and later transmit – any data that the monitoring port can’t handle in real time. Unfortunately, this is band aid approach and doesn’t actually solve the problem. Worse, it introduces new latency and timing issues into the environment.

If buffering is not the solution, what is?

Creating a False Sense of Security

Even if you are willing to disregard latency and timing problems, the typical buffering solution doesn’t provide enough relief to ensure that packets won’t be dropped during a heavy traffic spike. 

Consider the following from Wireshark expert Andrew Brown in his recent Sharkfest presentation, Maximizing Packet Capture Performance:  

• Packets take 1.48 seconds to send
• 20MB buffer takes - 2.5 seconds to write
• 512MB buffer takes - 46 seconds to write

That means that even a 1,000 MB buffer on a copper GB network TAP would reach capacity in just 89.8 seconds. Clearly, this can’t be considered an effective solution to traffic management challenges.

Download Now: Network TAPs 101 - The Networking User Guide [Free eBook]

Skip the Workarounds – Rely on Best Practice Connectivity Approaches

Today, escalating network usage and traffic spikes are a reality that every network engineer must plan for. When designing a network connectivity architecture, there are several best practice strategies that allow you to effectively utilize aggregation TAPs without compromising the integrity of your security and network monitoring programs:   

• Switch Aggregation TAPs to Breakout T­AP Mode: When traffic spikes, the best insurance against packet loss is to simply reconfigure the network TAP to breakout TAP mode, which breakouts the transmit (Tx) and receive (Rx) traffic to two separate monitoring ports. 

• Reduce your Aggregation Group: Today’s engineers don’t just use aggregators to integrate east-west and west-east traffic into a single stream. They also use them to collect traffic data from up to four network TAPs inserted at different points in the network and send them to a single monitoring port on a device. When network utilization rates increase, administrators can simply limit the number of traffic streams that are being aggregated at one time.   

• Apply Traffic Filters: While next-gen firewalls need to see every bit, byte and packet^®, other devices (VoIP monitoring tools, lawful intercept devices, etc.) may not need to analyze 100% of the traffic flow. With an advanced filtering solution, you can granularly separate and direct layer 2, 3 and 4 data to specific appliances depending on their exact needs. This lets you reduce port requirements, support more devices from a single aggregating TAP and enrich results with data from multiple points in the network.

Automate the Process to Ensure Success

At Garland, we understand that having to manually monitor traffic levels and adjust network TAP settings is not an efficient way to spend your day. Therefore, we added a management controller to our 1U and 2U chassis to provide the flexibility you need to mitigate risk and control traffic spikes in a way that best supports your unique goals. Now, you can set up an SNMP or Syslog alert to notify you when specific monitoring ports hit their 80% utilization rate, allowing you to take corrective action before packet loss can occur.

Aggregation TAPs are critical to creating a strong, cost-effective network connectivity program.  However, they are not all created equal. To learn more on the advanced functionality of aggregation and filtering, download our white paper, Maximizing Visibility. 

Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!