Ethernet TAP

What is an Ethernet TAP?

Ethernet TAPs are devices that make it possible to tap the data traffic at certain points in the network. The Ethernet TAP records the data including errors and forwards them without loss to corresponding analysis tools such as Wireshark.

TAP is the abbreviation for "Traffic Access Point" or "Test Access Point". It is hardware that is used at points in the network where data can be retrieved for error analysis and testing purposes. Network Ethernet TAPs are mainly used to monitor network traffic between two points A-B in a network infrastructure.

Ethernet network TAPs usually consist of four ports in the smaller version. A network port A and B and two monitoring ports A and B. The data traffic in the network is derived from the network ports to analysis tools. For more complex applications regarding the data and network structure, more powerful Ethernet network TAPs are available depending on the requirements.

The functionality of an Ethernet TAP in the standard version is explained very simply. As a rule, these systems are sufficient to meet most requirements in small and medium-sized networks.

The network ports of an Ethernet network TAP collect the data traffic from the network. Network port A receives eastbound traffic and network port B receives westbound traffic. The monitoring ports pass a copy of this traffic to a connected network analysis tool. Monitoring port A copies the eastbound traffic, and monitoring port B copies the westbound traffic.

So, to summarize, the way it works is simpler. Normally, an Ethernet network TAP is placed between two points in the network. The network cable between points A and B is replaced by a pair of cables connected to the network TAP. Traffic is passively routed through the network TAP without the network knowing about it. In this way, the TAP can create a copy of the traffic sent out of the monitoring port to be used by another tool without changing the traffic flow on the network.

What is the Ethernet Network TAP needed for?

Some of the most popular methods for accessing network traffic are using a SPAN/VACL port on a network switch or connecting a monitoring device on the network. However, both of these connection scenarios are problematic due to security issues and susceptibility to errors. These methods can definitely be solved more easily with an Ethernet network TAP, as these vulnerabilities cannot arise. An Ethernet network TAP (also called a breakout TAP) is the best solution to guarantee the user to pass all network traffic, including errors, to monitoring ports A and B respectively.

In this context, other types of network TAPs should not go unmentioned. Although the Ethernet network TAP is a system to capture all traffic on a network, there are other scenarios and types of network TAPs. For example, a network TAP for when it is unimportant to see all traffic, and a network TAP for monitoring inline devices such as an intrusion prevention system (IPS).

With aggregation network TAPs, in the case of the first scenario, it is possible to combine eastbound and westbound network traffic onto a single monitoring port

(aggregation). In this way, only one monitoring port is used to aggregate eastbound and westbound traffic on one monitor port.

The second scenario is a solution for SPAN/regeneration TAPs. Regeneration Taps allow the user to send unidirectional traffic from one network segment to multiple monitoring tools. With this method, it is possible to send a single data stream to a number of different monitoring tools, with each monitoring tool serving a different purpose.

Not to be left unmentioned in this context is the Bypass Switch or Bypass TAP, or also called In-Line TAPs. These taps allow the user to position an active network tool "in-line" on critical connections. Bypass Switches or Bypass Taps are used where monitoring devices need to be placed "in-line" on the network to be effective, but placing these devices "in-line" compromises the integrity of a critical network. Placing a bypass TAP in place of the monitoring device and connecting the monitoring device to the bypass TAP can ensure that the network connection continues to function, and the inline device does not become a "critical failure point".