.jpg)
Taps, Spans or Mirror
Taps Pro:
- Provides full visibility into full-duplex networks
- Monitoring device receives all packets, including physical errors
- Eliminates the risk of dropped packets*
Taps Con:
- Analysis device may need dual-receive capture interface*
- Additional cost with purchase of TAP hardware
- Cannot monitor intra-switch traffic
*Refers to a Full-Duplex nTap, not an Aggregator nTap
Spans/Mirror Pro:
- Low cost
- Remotely configurable from any system connected to the switch
- Captures intra-switch traffic
Span/Mirror Con:
- Cannot handle heavily utilized full-duplex links without dropping packets
- Filters out physical layer errors, hampering some types of analysis
- Burden placed on a switchs CPU to copy all data passing through ports
- Can change the timing of frame interaction altering response times
- Switch prioritizes SPAN port data lower than regular port-to-port data
Overview:
When deciding whether to use a TAP or SPAN the two primary factors that will affect your decision are the type of analysis and amount of bandwidth. A SPAN port performs well on low-utilized networks or when analysis is not affected by dropped packets. A TAP is ideal when analysis requires seeing all the traffic, including physical-layer errors. A TAP is required if network utilization is moderate to heavy. An Aggregator TAP can be used as an effective compromise between a TAP and SPAN port, delivering some of the advantages of a TAP and none of the disadvantages of a SPAN port.