In a world of shrinking IT budgets, many are turning to network aggregating TAPs to reduce costs within their security and network monitoring programs. Because aggregating TAPs integrate multiple traffic flows into a single stream, IT can then purchase monitoring and security solutions with less port density per appliance.
However, there is a tradeoff. IT must ensure that the connected devices don’t become overwhelmed by traffic as network utilization rates increase and spikes occur.
To combat short term bandwidth issues, some vendors have added buffering to their TAPs in an attempt to capture – and later transmit – any data that the monitoring port can’t handle in real time. Unfortunately, this is band aid approach and doesn’t actually solve the problem. Worse, it introduces new latency and timing issues into the environment.
If buffering is not the solution, what is?