Leading network TAP manufacturer, Garland Technology, has partnered with NextComputing, the premier OEM supplier of open, full packet capture systems. Together, they will provide joint solutions for 100% lossless packet capture for forensics, security and monitoring applications.
The partnership began in early 2016 and is rapidly developing to include joint solutions for NextComputing’s Packet Continuum Cluster and Packet Continuum Portable applications. In a recent webinar hosted by Palo Alto's Fuel User Group, Chris Bihary showcased how the integration of Palo Alto’s Next-Gen Firewall, combined with NextComputing’s Packet Continuum Cluster can be utilized with Garland’s EdgeLens®, to facilitate time critical workflows for security incident response.
“It’s exciting to be partners with NextComputing because they are leading the industry with their packet capture systems. Because our Edgelens® is a hybrid bypass TAP and packet broker it can provide identical traffic to an inline NGFW/IPS as well as NextComputing’s off-line Packet Continuum capture appliance. When both devices receive identical traffic streams, it allows for precise correlation of events through extracted PCAP files.” said Chris Bihary, CEO/Co-Founder of Garland Technology.
Garland Technology’s EdgeLens® was designed specifically as a connectivity tool to monitor the network’s edge, and as a centralized management tool for multiple security and management tools.
“The partnership with Garland Technology and their EdgeLens® plus Packet Continuum allows for a variety of use cases, including recording traffic before and after the in-line device. This is beneficial when auditing new policy signatures to ensure they operate correctly,” said John Ricketson, NextComputing’s Executive Vice President.
To learn more about joint solutions from NextComputing and Garland Technology, visit their technology partner page.
About NextComputing
NextComputing is the premier OEM supplier of open, massively scalable, full packet capture systems. Our Packet Continuum technology achieves lossless capture to disk at high line rates up to 40Gbps, real time indexing, in-line data compression, PLUS simultaneous query and deterministic retrieval of pcap data. Active Trigger alerts and packet analytics make Packet Continuum ideal for cyber security protection, incident response, and network trouble-shooting. Packet Continuum software operates on a standalone appliance (portable or rackmount), or across a cluster of enterprise-grade servers, for massively scalable forensic timelines and advanced analytics. Learn more at http://www.nextcomputing.com.
About Garland Technology
Garland Technology guarantees precise data monitoring capabilities with a full line of network access points (TAPs) including: network TAPs that support breakout, aggregation, filtering, regeneration and bypass modes; packet brokering and load balancing; all available in portable or 1U or 2U modular chassis systems. Garland network TAPs support all networks, including copper wire in 10/100M, 10/100/1000M and fiber in 1G, 10G, 40G, 100G. Garland’s network TAPs avoid introducing additional software that could be a point of failure to your network.
Garland’s design and educational-based approach includes a team of network designers to work directly with you and your team to meet your network access and visibility needs and provide you with the best solution for any monitoring or security appliance - allowing you to see every bit, byte and packet®. For more information, visit http://www.garlandtechnology.com.
If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.
If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.
While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.
Some of you may have noticed a flaw in the logic behind this solution! You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.
Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.
Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.
Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.