Network TAPs

Researching Network TAPs - an end to network blindness? (part 3)

I have now gotten back around to working on this activity. In case you have forgotten what I am working on, please review part 1 and part 2.

I have ordered the Datacom Singlestream SS102 Link Aggregation Tap. I placed the order last Friday. On Monday, my supplier said that it could take more than two weeks to receive this product. I was surprised by the lead time required for this device. I was first told that it could take 4 weeks for the product to ship. I am in more of a hurry than that and was about to change to a different higher-cost product to pressure the supplier to have a quicker delivery.  The conversation seemed to have worked.

My alternative choice was the Network Instruments nTap. However, it was almost a 50% premium over the Datacom solution. The link I need to monitor is not a high speed link so I really do not need the memory buffer that NI’s equipment offers. I was just willing to consider it if I could receive and implement the solution quicker.

I will let you know how the product works and any issues I encounter during implementation.

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Researching Network TAPs - an end to network blindness? (part 2)

As expected there are several different manufacturers and models that can handle this task. The reseller I spoke with suggested three different devices from two different manufacturers.

Network Instruments nTAP - This is the particular device that initially captured my interest in this type of solution. More information can be found here

Datacom Systems Singlestream aggregation tap - More information on the 10/100 aggregation tap can be found here. Details on a gigabit tap can be found here.

The prices I received on these devices went from around $1000 to $1500 to $2000. As you can see, there are lots of choices. I have requested a demo model of the $1000 device and will see if it will meet my needs. More to come!

Thanks for your time. Let’s be good network citizens together & practice safe networking!

Researching Network TAPs - an end to network blindness?

What is the best means of watching data network traffic at the edge? My need: watch traffic inbound and outbound at the edge of the LAN and be able to remotely view reports. The reports would show information such as: current traffic flow volume & conversations; historic traffic flow volume; netflow data; latency from LAN to remote hosts.

So, some questions need to be asked and some answers given.

Where to place potential solutions:

1. In the router or “cloud”.
2. In the edge LAN switch.
3. Between the router and the edge LAN switch.

What are the potential issues with sensor location:

1. Router or “cloud” - network address translation (NAT) may hide actual source address information. What load would this service put on the router? Would there be any costs for implementing this on the router and/or in the cloud? We use managed data network services so this could be a concern.
2. LAN edge switch - is port spanning or “mirroring” a valid option? What other monitoring services can the switch provide? SNMP or RMON? How would the monitor be remotely accessed if there is only one NIC and it is in listening mode only? Note that placing a destination switch port in span mode does not permit any outbound traffic to occur on that interface.
3. Between the LAN & WAN - is another switch needed with port spanning/mirroring? Would a hub work with it creating a half-duplex link for inbound/outbound traffic?

What hardware provides potential solutions:

1. Router or “cloud” - not the preferred method since not under my control and may have change request or monthly service costs involved.
2. LAN edge switch - monitoring system would require dual NIC’s; one to listen/monitor and one for remote access. Port spanning or mirroring could place a load on the switch. SNMP or RMON queries can add traffic to the network link and impact the monitoring accuracy.
3. Between the LAN & WAN - a hub is not desirable due to the fact mentioned above. It causes a full-duplex link to go to half-duplex and creates a bottleneck even though the WAN link is usually much smaller than the LAN. There is an alternative to the hub. That device appears to be called a network TAP or port aggregator. This is the solution I plan on investigating further.

Has anyone else had experience with implementing a network TAP or port aggregator for network monitoring? I will also discuss what applications I plan on using to monitor network traffic in a future post.

Thanks for your time. Let’s be good network citizens together & practice safe networking!