What is a Link Aggregation TAP?
In its most basic application, a link aggregation tap is similar to a traditional network tap - it is a dedicated device that is inserted into a network segment and allows you to access and monitor your network traffic.
While traditional taps do provide full-duplex monitoring of all traffic on a network link, they transmit data in two separate half-duplex streams (one for Tx and one for Rx) to the connected monitoring device. This requires not only that the monitoring device have two network interface cards, but also that the link aggregation TAP be able to combine and process both streams of data to monitor both sides of the call. Not all monitoring systems, even the most popular software solutions, have the necessary hardware to aggregate traffic.
A link aggregation tap from Datacom Systems combines both directions of a full-duplex data stream and allows any connected monitoring device, even those with only one NIC, to receive a copy of all data - in a single trace file.
Why Aggregate Traffic?
Increasing demand for network service and performance means that both network utilization and network speeds are constantly increasing. Network professionals need to deliver fast, efficient services to more people than ever before. Security professionals need to secure more people. And the demand for data analytics is growing exponentially. The ability to access, monitor and analyze network traffic from multiple sources (i.e., data aggregation) is an important and common requirement in network and data analytics.
Organizations can consolidate traffic from a large number of network connections at different speeds and reduce the critical data to a number of ports that can be managed efficiently. Aggregating traffic reduces network complexity, increases throughput and optimizes the performance of monitoring, analysis and security tools.
Other use cases:
- The number of links you need to monitor exceeds the number of available tools
- Your network links and tools don't have the same speed or media type (media conversion)
- Reduce costs with less "per port" or licensing fees charged by some tool vendors
Many-to-any monitoring access aggregates network traffic and provides visibility to one or more monitoring tools. Aggregate and reassemble full-duplex connections from one or more trunked links. Perfect for tools that do not support multiple monitoring interfaces, or for redundant networks, EtherChannel, load balanced servers, and asymmetrically routed traffic.
Any-to-many configurations replicate copies of identical network traffic to allow multiple tools monitoring access to the same links. In addition to eliminating contention for scarce SPAN ports. Test access points can be connected to the same link across multiple tools for redundancy, testing, or advanced monitoring applications.
Distribute traffic across multiple ports to allow for traffic distribution as data volumes increase. Load balancing helps prevent data loss by enabling the use of redundant security tools that can back each other up in the event of a failure or during a software update. As connections get faster, you need to be able to distribute traffic to analytics tools at slower speeds. With load balancing, you can extend the life of existing lower-speed devices as your network traffic increases.
Instead of tools trying to keep up with high-speed aggregate streams, VERSAstream can apply packet filtering to data to increase tool efficiency and avoid port overcrowding. Line speed hardware filtering on each port allows you to adjust and optimize the amount and type of data each connected monitoring tool receives. By receiving only traffic of interest, tools run faster, data is more manageable, and problems are resolved more quickly. Filter on - Ipv4 Src/Dst address; MAC address; protocol, port and ethertype (e.g. MPLS, VLAN, IPv6 Src/Dst address).
Here you can find an overview of Datacom Link Aggregation TAPs.