13

I predominantly work in a Cisco environment and contemplating buying a network tap device for use with Wireshark.

Can anyone provide the pros and cons from their experience between using network taps OR setting up port mirroring given considerations like ease of use, cost of kit and are there limitations between the 2 approaches respectively?

4 Answers 4

19

(having worked with this for a decade now)

Hands down, the biggest functional difference between a tap and a span... a passive tap will never, ever drop a frame, under any circumstances -- it electrically duplicates the frame, errors and all. Active taps (regenerative, or aggregate) can drop frames, eg. if the bidirectional traffic exceeds the link speed of the monitor port. (a 1G link cannot carry TX+RX 1G (2G) of traffic)

Switch SPAN ports will drop traffic. The SPAN is the lowest priority to the switch -- it will sacrifice the SPAN traffic in favor of maintaining live traffic. A slightly loaded switch may never show this, but I've had dozens of customer calls from all over the world complaining that we dropped traffic, when it was in fact their switch SPAN that didn't send it to us.

However, SPANs are cheap and plentiful. Almost every managed switch supports setting up a monitor session. And they are usually trivial to setup and/or reconfigure. Taps, on the other hand, are exceedingly expensive and rare. Taps require unplugging network cables, which has a lot of resistance from just about everyone. And they cause a hit when they lose power. (momentary, not "unplugged == broken link". even dirt simple ones will maintain link when off.)

1
  • 2
    Great answer. I think this tells us the preferred way the NSA grabs traffic. ;-) May 20, 2013 at 8:34
11

Even though SPAN can (will) drop frames when TAP would not, Cisco switches (and maybe others) have a cool feature called RSPAN.

It allows to set up a remote SPAN, to transport captured frames over the network to the monitoring station:

cisco_rspan

1
7

In my experience physical network taps give you much more flexibility. Many Cisco platforms have restrictions on the number of SPAN ports/monitoring sessions.

By using physical network taps you're able to directly monitor several different ports without using CPU overhead on the Cisco device itself.

Also worth considering is the cost for physical taps. Physical taps incur an additional capital expense, while there is no additional outlay to use the built-in span functionality.

--

Recently I had to spec out the install of some call-recording software for our Cisco VoIP implementation. In several locations, it made sense to use physical taps to span the voice traffic to the recording server as the number of sessions needed would have exceeded the switch's capability.

3

In addition:

Taps: will not suffer from buffering/timing changes induced by a SPAN session under loaded conditions - could be important in low latency environments where nanoseconds are significant, and hardware timestamps are in use.

SPAN: you can select two ports as destination ports, one for the TX side and one for the RX side, but this depends on the platform. This solves the 2 to 1 oversubscription problem.

Basically, what it comes down to is that SPAN can introduce additional artificial variation in the timing and potentially the ordering of the packets which can be a problem for some types of analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.