The term TAP is an abbreviation and stands for Test Access Port. A Network TAP, also known as an Ethernet TAP, provides a passive access point to an optical or copper-based network connection, enabling the data signals transmitted over the cable to be read and evaluated securely and reliably for analysis purposes.
These TAPs are looped into the network line to be monitored and forward all data traffic while maintaining data integrity, without interruption and without packet loss.
Once installed, a TAP can be used to transparently deliver all traffic to various monitoring applications quickly, easily, and without affecting the active network line.
In contrast to data tapping via a SPAN port, you get a much more accurate measurement result when using a TAP and can thus identify network and application errors even faster and more precisely. This saves you valuable time when troubleshooting network errors and problems.
Instead of the time-consuming configuration of SPAN ports, Network TAPs can be installed and commissioned plug-n-play, without any prior technical knowledge, in a very short time. For good reason, Cisco, the world’s leading network equipment manufacturer, therefore deliberately advises against the use of such SPAN ports for network analysis.
Network TAPs have another decisive advantage due to the way they work: they fully route bi-directional data traffic. This means that you receive the send and receive directions of a full duplex line separately and can therefore, for example, analyze a 1G line loss-free even with a maximum load of 2Gbps. As a result, you need two network interfaces on the analyzer to record the network data.
Using this method, the sending and receiving directions can be easily differentiated from one another, which eliminates another source of error. SPAN ports, on the other hand, must aggregate this data in memory before it is passed on to the SPAN port, but this is not one of the primary tasks of a switch and thus has a significant negative impact on the quality of the analysis result.
Furthermore, due to the use of mirror ports, the switch processor is more highly utilized, which can cause data loss on the SPAN port.
This line of our PacketRaven Network TAPs are designed as portable TAPs, but can also be installed in a 19″ mounting frame in data centers using a mounting kit, and support network speeds of 10/100/1000Mbps (10/100/1000Base-T), 100Mbps (100Base-FX), or 1000Mbps/1Gbps (1000Base-LX, 1000Base-ZX, 1000Base-SX).
A PacketRaven Network TAP operates on OSI Layer 1 and has no MAC address. It is therefore invisible in the network and cannot be detected by any attacker. This is essential, especially in network forensics and security, as otherwise criminals might be suspicious of the presence of the TAP.
Furthermore, our Network TAPs behave passively on the network side, which means that there is no interruption of network traffic in the event of a power failure (the only exception is our SFP TAP).
In order to ensure the highest possible reliability on the monitoring side, these TAPs have redundant power supplies, but can also be additionally operated or fused with 12-48V DC voltage. With our copper TAP, power supply via PoE is even possible in addition.
Furthermore, all our TAPs with active monitoring output (RJ45 and SFP) work like a data diode. This means that the monitoring ports are physically isolated from the network ports and, for security reasons, access to the network via the monitoring ports is prevented on the hardware side.
Thus, by adding this additional security layer, it is not possible to compromise the network connection and the production network.
Hardened TAPs - here, attackers really bite the dust
PacketRaven Network TAPs are therefore already in the standard version among the network components via which an attack vector is excluded.
For high-security areas according to IEC 62443 and critical infrastructures (CRITIS), however, even this is sometimes not sufficient, which is why NEOX NETWORKS now also offers a specially hardened version of its TAPs.
These TAPs can be delivered pre-configured, if desired, and then do not allow any subsequent configuration changes.
In addition, they are secured against unwanted or unnoticed opening by special screws and security seals.
And to top it all off, these TAPs also have specially secured and encrypted firmware. Secureboot checks each time the TAP is started whether the firmware to be executed has a valid signature and an authorized public key.
If this is not the case, the TAP cannot be put into operation.
PacketRaven STANDARD FEATURES
Safe, rock-solid FPGA-based design
Supported network speeds: 10M, 100M and 1G
Alternative to SPAN ports – mirrors 100% of traffic including FCS/CRC errored packets that may be dropped by SPANs
Invisible in the network, no IP address, no MAC address, cannot be hacked
Power supply via redundant AC/DC power supplies (5V) and/or 12-48V DC voltage and/or PoE*.
„1GA“ means available for (up to) 1Gbit as well as Aggregation- AND Breakout mode; „1GAO“ for (up to) 1Gbit but ONLY Aggregation mode available; „1GBO“ for (up to) 1Gbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each.
„1GA“ means available for 1Gbit as well as Aggregation- AND Breakout mode; „1GAO“ for 1Gbit but ONLY Aggregation mode available; „1GBO“ for 1Gbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each. ** All OS2 types are also OS1 compatible.
„1GA“ means available for 1Gbit as well as Aggregation- AND Breakout mode; „1GAO“ for 1Gbit but ONLY Aggregation mode available; „1GBO“ for 1Gbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each. ** All OS2 types are also OS1 compatible.
„100MA“ means available for 100Mbit as well as Aggregation- AND Breakout mode; „100MAO“ for 100Mbit but ONLY Aggregation mode available; „100MBO“ for 100Mbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each.
„100MA“ means available for 100Mbit as well as Aggregation- AND Breakout mode; „100MAO“ for 100Mbit but ONLY Aggregation mode available; „100MBO“ for 100Mbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each. ** All OM4 types are also OM3 compatible.
„1GA“ means available for 1Gbit as well as Aggregation- AND Breakout mode; „1GAO“ for 1Gbit but ONLY Aggregation mode available; „1GBO“ for 1Gbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each. ** All OM4 types are also OM3 compatible.
„1GA“ means available for 1Gbit as well as Aggregation- AND Breakout mode; „1GAO“ for 1Gbit but ONLY Aggregation mode available; „1GBO“ for 1Gbit but ONLY Breakout mode available!
* "-ERW" for models with mounting frame for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each.
