Aggregation TAPs possess the ability to combine multiple data streams or, as the name suggests, aggregate. This results in a substantial advantage: this feature enables you to analyze multiple streams using a single network interface on your monitoring tool. When aggregating a single network connection, the method is called Port Aggregation. If the aggregation is exerted on multiple lines, this technique is known as Link Aggregation.
The graph on the top left shows the diagram of a Port Aggregator TAP. As you can see in the picture, here the TX and RX line of a network connection is each aggregated at Ports C and D, with which one is able to monitor the bundled data of a full-duplex connection by using a single network interface. Ports C and D, therefore, each receive the entire traffic of a network link and this aggregation method enables you to analyze the network data with multiple monitoring tools simultaneously such as OmniPeek or Wireshark or any Security device of your choice.
Aggregation TAPs from Garland Technology optionally do support the operation in Tap Mode, which is also called break-out mode. A DIP switch allows you to change between these functions back and forth. This is a significant advantage, allowing you to use the Tap if necessary in break-out mode and enables you to do full-duplex analysis if required. In addition, a Port Aggregation Tap can also be used as a Regeneration TAP, as can be seen on the diagram above right. In this case, the incoming signal on port A is copied to port B, C and D. This is a convenient method of regenerating a simple signal without a complex configuration of up to 3 ports, which allows you to analyze the data applied with 3 different monitoring tools simultaneously.
Due to the physical speed limit of the network interface, you can analyze with Port Aggregation TAPs in Gigabit networks with a maximum traffic speed of 1Gbps. This should be considered, since exceeding this capacity can cause packet loss and error-free capturing isn’t any more assured. In such a case, the use of TAPs with filter characteristics is recommended. These so-called intelligent/filtering Taps can sort out the traffic according to defined criteria on OSI Layer 2-4 and only give the desired data to the Analyzer. One can, therefore, specifically reduce the amount of data on the output port and only receive the information passed on, which is of relevance.
A further method to reduce the amount of data, without neglecting essential information, would be Packet Slicing. Use this function to slice the frames reduced accordingly by removing the user data from the payload. All the information required for the analysis is naturally preserved with this method, and only the user-relevant information from the application layer (payload) is deleted. This means that you can also manage and analyze targeted and reliable large volumes of data without compromise. Our modular aggregation TAPs support Packet Slicing, allowing you to determine the value of the separated contents. In this way, you can trim the user data of users and are able to carry out legally compliant network analysis without violation of privacy.
The Link Aggregation is a popular method to evaluate network data from multiple network links on a dedicated monitoring port. The advantage is that you can analyze the network data from many network access points simultaneously with a single analyzer. You can get an improved and more accurate overview of the network packets and this technology helps you to perform measurements and even identify performance bottlenecks more reliable. Garland Technology offers a compact Link Aggregation Tap with 10 ports, of which 8 ports serve as network TAPs and the remaining 2 interfaces are designed for output. This compact aggregation TAP can operate simultaneously as an in-line device in 4 lines but also supports the aggregation of 8 SPAN streams. The built-in network TAPs are naturally passive and are transparently looped-into the live network line without introducing a point of failure. Using the SPAN method where the mirrored data coming from a network switch is simply connected to the input ports. This Link Aggregation Tap supports the variable allocation of network ports to the monitoring ports, which you determine to be the aggregated data itself and this flexible mapping can change at any time. Furthermore, you have the ability to perform this TAP analysis in full-duplex mode. This is done by separate aggregation of the TX and RX streams of all connected network lines. This means that you get on the 2 monitoring ports the TX and RX separately and would be able to analyze the upstream and downstream independently. Another advantage of this method is that you can analyze the network data of 4 full-duplex wires or 8 SPAN ports up to a bandwidth of 2 Gbps without packet loss. In the standard aggregation, one would only be able to evaluate a maximum 1Gbps loss with a regular TAP. Through the existing 2 monitoring ports, all the data in the half-duplex aggregation is doubly available, allowing you to easily perform a redundant analysis.
A central load distribution would be another intelligent way to manage the data for monitoring purposes. More information can be found under the heading "Network Packet Brokers". There you will find relevant products and a more detailed description of intelligent "load balancers."
An external intervention in the active network management through the operation of a TAP is not supported by default, since network TAPs can be compared to the operation with diodes and do not require any technical intervention. This is important for safety reasons because otherwise a manipulation or deliberate malicious attack could be enabled in this way on your network. Nevertheless, it is necessary in some cases, or advantageous, to have such an option to actively intervene in the network events. Through this method, you could deliberately reset TCP connections or by generating network packets in the line in order to observe the behaviour of certain security systems. The chart above illustrates the operation of this injection method. TAPs with this property must be ordered separately, and the function can be easily turned on and off through the management interface. In the portable version, however, this is done via DIP switches. Our Aggregation TAPs are available in portable versions as well as modular systems.
Modulare Chassis Systeme für Aggregation Taps