Packets don’t lie – well, most of the time.

They tell the truth unless they have been captured incorrectly. In those cases, packets can tell bold-faced lies.

When digging through trace files, we can come upon symptoms in the packets that may raise an eyebrow. These are events that look strange on the surface and may even divert our troubleshooting focus for a time. In fact, some of these issues have misdirected engineers for hours, if not days, causing them to chase down issues and events that simply did not exist on the wire.

For years now we all have read about the difference between data capture off a span/mirror port and an inline network TAP. In fact, many of those comments have come from one of the great moderators of lovemytool.com, Tim O'Neill, the @OldCommGuy who loves the TAP side of the ring.

Packet Pioneer was interested to see the difference between a data stream captured on a network TAP versus a SPAN port. So they set up a test with a few PCs, a TAP, a SPAN port, a couple of hardware network analyzers, and a healthy stream of data.

The results were interesting, to say the least: The study showed that Tim O’Neill is correct!

Thank you networking community! You voted and we are pleased to announce the top 'Tap into Technology ' blog posts of 2016.

Below are the top 3 posts from 2016. Thank you for being a part of the Garland community and we look forward to the exciting network news, products and information 2017 will bring.

How trusted does your data have to be?

In today's world of data breaches and hacks, it is best to be capturing 100% of your data.

In the court of law, dropped packets equal unsubmittable evidence.

Learn what makes network TAPs approved for CALEA and Lawful Intercept cases.

The two most common methods to access network data are via a Network TAP or from a SPAN port.

How much do you know about Network TAPs? If you don't use them, maybe you think it's just another failure point or there may be a forwarding delay. If you do use them you probably consider them a must have.

What if I can answer some of those questions you may have in a few quick points?

Most network engineers are familiar with how to configure a SPAN port on a switch. This is a common way to get access to the network data to perform network analysis and connect various packet capturing monitoring tools to it.

When considering packet capture and monitoring of voice-over-IP (VoIP) traffic, it is important to keep in mind that VoIP is highly susceptible to packet loss, latency and jitter and is a frequent area of network troubleshooting.

So let me ask you. Besides configuring a SPAN port, do you know the importance of the mirrored data quality in packet analysis?