TAP Into Network Analysis

Choose The Products
The products the solution provider chooses depend on what's in the network. There are products that are best optimized for 10-Mbit networks, and others for 10-Gbit. The speed of the network matters, as well as the size of the data center. Network Critical offers a range of portable TAP appliances, such as purely passive units that are used in the field for troubleshooting and configuration TAPs capable of Gigabit aggregation.

If the customer doesn't already have an analyzer, the solution provider should bundle one in with the TAPs. The protocol analyzer takes the data coming from the TAPs to understand what is happening. There are a variety of analyzer solutions, including forensic monitoring, sniffers and probes, e-mail and spam filtering, intrusion detection and intrusion prevention, and VoIP-analysis tools. ClearSight Networks is an example of a vendor offering sniffers. Fluke Networks also offers analyzers that can work with its TAP appliances.

All Network Critical TAP products are plug-and-play modules and are compatible with everyone, Hagerty said. Network Critical also offers a ConneX chassis for its portable TAP units. Network Critical TAP appliances are fairly affordable, Hagerty added, with products in the $300 range.

Since TAP can handle traffic over both copper and optical fiber, it can be used in essentially any Ethernet network. While it generally sits between the router and LAN Link, connecting to both with ordinary RJ-45 cables, there is no limit to the number of appliances to install. The actual number deployed depends entirely on customer preferences—such as having a separate unit for each switch or hub on the network.

Customers may have multiple devices on the network watching the same traffic. It's not necessary to buy a TAP for each device, although there is nothing stopping the customer from doing so. Solution providers can point out that most TAPs can output traffic to multiple devices without degrading the traffic or losing packets.

While the focus of this piece is on network TAPs, hubs are actually decent replacements in the 10/100 HDX (not Gigabit) environment. There are some issues associated with using a hub, but it's an alternative for a quick and temporary access. This is particularly the case for end-terminus analysis. Issues like an auto-negotiate mismatch between the switch and the server can be easily solved with a hub.

Next: STEP 3 Easy as 1-2-3