A tap--internal or external--is a passive wiring device that copies traffic on full-duplex Ethernet segments, and sends this copied traffic information to the S processors for analysis.
Full-duplex taps split a link into separate transmit and receive channels. Sensors provide multiple monitoring interfaces to monitor the two channels, and Sensor ports are wired in pairs in order to accommodate full-duplex taps. Two monitoring ports are used to monitor one full-duplex link using a tap.
The benefits to using Sensors in tap mode are:
- Monitor uplinks passively -- Taps cause no latency in your network traffic. You essentially sniff traffic as it passes.
- No need for SPAN ports -- On most switches, the SPAN port operates in half-duplex mode, so the maximum bandwidth a Fast Ethernet port can handle is 100 Mbps before it begins dropping packets. If the uplink is running at more than 100Mbps aggregate, a Fast Ethernet SPAN port can't handle it; a full-duplex tap can. Another issue is that there are a limited number of SPAN ports supported on most switches, and there is typically a lot of competition for them (for example, for RMON probes, sniffers, etc.).
- Traffic continues to flow if the tap fails -- Completely passive and fault tolerant, taps provide fail-safe operation with no impact on network connectivity or performance. Taps fail open, meaning that a failed Sensor permits traffic to continue to flow unimpeded.
The downside of tap mode is that, unlike in-line mode, you cannot prevent attacks. Tap mode is passive; the Sensor essentially sees malicious traffic as it passes, so sensing an attack in tap mode triggers a response post-attack. You also cannot inject response packets back through a tap; the Sensor provides Response ports to inject response packets.
.png)