Black Box TS255A Spécifications télécharger pdf (Page 16)

Choosing between a SPAN, Aggregator, or full-duplex TAP

Chapter 1 TAPs Overview

rev. 1

NOTE: TAP BUFFER

The role of the buffer is to absorb traffic spikes of over 50%

full-duplex bandwidth saturation (100% with both sides

combined), because the analyzer’s single-receive interface

cannot receive the traffic fast enough to keep up at line rate.

For more details about the Aggregator TAP’s buffer, see

“Choosing an Aggregator TAP buffer size” on page 43.

An Aggregator TAP is ideally suited to work with an analysis device

with a standard, single-receive capture interface or NIC. This means

that a laptop or a standard system can be deployed as an analyzer

rather than the more expensive specialized analyzers or appliances

that are designed to accept full duplex traffic through a dual-receive

capture interface.

Just like a SPAN/mirror port, an Aggregator TAP is ideal for a lightly

used network that occasionally has utilization peaks above the capture

capacity of the analyzer. Unlike a SPAN/mirror port, the Aggregator

TAP will forward Layer 1 and 2 errors to the analysis device.

Another advantage the Aggregator TAP has over a SPAN/mirror port

session is its internal memory buffer. The memory buffer provides

limited protection against packet loss, and if the network utilization

does not regularly exceed the capacity of the analyzer’s capture card,

an Aggregator TAP may be the right choice.

The appropriate solution for capturing full-duplex data for analysis

depends on the rates of traffic you must monitor, and what level of

visibility you require. When monitoring a lightly-used network, using

a SPAN/mirror port or Aggregator TAP to supply an analysis device

with a standard NIC (i.e., single-receive) interface can be an

economical choice. The Aggregator TAP can provide protection

against packet loss, but if usage spikes exceed its buffer capacity

before the link to the analyzer can catch up, the Aggregator TAP

drops packets.

To monitor a critical, heavily utilized full-duplex link, a full-duplex

TAP is the only alternative. Monitoring a full-duplex connection using

a full-duplex TAP and an analyzer with a dual-receive capture

interface guarantees complete, full-duplex capture for monitoring,

analysis, and intrusion detection regardless of bandwidth saturation.

See “Aggregator TAPs” on page 41 for full details about the TAPs.

1 2 ... 11 12 13 14 15 16 17 18 19 20 21 ... 63 64

Pas de commentaire

Black Box TS255A Spécifications Page 16