[c-nsp] Physical Network TAP devices

[James Bensley]

On 17 July 2017 at 18:39, Nick Cutting <ncutting at edgetg.com> wrote:
> Good afternoon,
>
> We have a use case now to capture traffic at one of our egress points, and we need to use network taps.  We need at least 2 sources and two destinations, in a pair of devices. - Copper 1 gig at this point.  Is anyone using Copper/ Fiber Taps at 10g?
>
> Can I please get some feedback on some of the brands of taps that you fine people use?
>
> We were looking at gigamon, but I have not used TAPs in a very long time.  We have a need to move to a physical device because of limitations in the hardware in where we need to capture the traffic.

Anytime I have had such a requirement, it has never turned into
actually buying a tap device. Specifically for 1G copper we just SPAN
the port. A small 8 port switch with a copper and SFP uplink port with
SPAN/port mirroring capabilities are usually cheap. Then you can have
6 links for example to it and SPAN them at will without a trip to site
to re-patch anything.

Similarly we needed to mirror some 10G ports once but only had servers
with 1G ports in those remote DCs, we just used a R-SPAN (GRE tunnel)
back to another DC.

You might need to elaborate on your requirements more. The only
requirement we have had for an actual "tap" device is for passive
fiber taps on more than 1Gbps (so 10Gbps, as 1G ports are just so
cheap these days).

Cheers,
James.