Tool Performance | TAP v SPAN Solution

How to ensure optimal tool performance?

The monitoring tools need packet data to properly analysis the task at hand. To get the data to these tools, your options are spanning a port from your switch or utilizing a network TAP. At the same time, it is imperative to not negatively effect the performance of these tools or the connected network.

SPAN ports generally do not effect the performance of the switch, but as SPAN port features vary among switch vendors, the impact SPAN has on switch operation can vary.

According to Cisco, when a SPAN sessions is created with many ports for sources, there is a performance impact as now the switch carries twice as much traffic. Each linecard replicates the traffic at ingress, whenever you SPAN a port all ingress traffic is doubled when it hits the fabric.

SPAN traffic has a low priority on switch, which can be good for switch performance but bad for SPAN performance

Takes up ports on the switch, which can be of high value

Admin/programming costs for SPAN gets progressively more time intensive and costly

Using data filtering to improve tool efficiency

With the growth in network traffic, analyzing this data is not only time consuming but expensive, as it usually includes an extensive number of tools. A more cost-effective technique is to isolate data that needs to be inspected, like VOIP traffic only, or traffic that has a higher risk of being a security threat) and focus on analyzing just that data.

This approach can be accomplished at the TAP level, with Garland’s XtraTAP or with a PacketMAX packet broker.

• Set utilization alerts for each monitoring port.
• Remotely change TAP modes (breakout) mode to avoid oversubscription.
• Set up filtering rules on layers 2, 3 and 4