How to Enhance SPAN Deployments
TAP vs SPAN
Challenge: When is it ok use SPAN?
As you may have realized, there are two options for network packet access to your monitoring and security tools -- Network TAPs and SPAN.
Enterprise switches have the ability to “mirror” or copy the traffic of one or more ports (or VLAN) through a Switch Port Analyzer (SPAN), also known as a mirror port. This is used to access and send packet data to monitoring and security devices for analysis.
With industry best practice indicating network TAPs provide better access. SPAN is still viable for some use cases, and is clearly still being used universally:
• SPAN ports can perform well on low-utilized networks.
• SPAN ports can be used in situations where dropped packets won’t affect network analysis.
• SPAN ports can be used for inventory of non-time sensitive monitoring.
• SPAN ports can be used for conversation or correction analysis.
• SPAN ports can be used with applications where real-time analysis is not a requirement.
• SPAN ports can be used in situations where dropped packets won’t affect network analysis.
• SPAN ports can be used to capture intra-switch traffic.
Solution
Network TAPs can enhance SPAN deployment
Yes, network TAPs provide 100% visibility to your network monitoring and security tools, but as SPAN is still being used, there are many TAP use cases that can enhance your current SPAN deployment.
Garland's network TAPs have SPAN or regeneration mode, which allows you to take one SPAN link and copy the same traffic to multiple tools (1:3, 1:5, 1:10).
Another good best practice to follow if SPAN port usage is required, Aggregator TAPs allow you to take those SPAN and consolidate them into just one or two links. This optimizes and reduces network complexity.
SPAN regeneration mode for network TAPs
SPAN aggregation with network TAPs