Which TAP is the right one for my network?

Question

I want to buy a TAP but I'm uncertain which device is the right one for my environment. The command sudo lshw shows the following about my Ethernet:

       *-network
            description: Ethernet interface
            product: RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller
            vendor: Realtek Semiconductor Co., Ltd.
            physical id: 0.1
            bus info: pci@0000:03:00.1
            logical name: enp3s0f1
            version: 12
            serial: 80:fa:5b:3b:de:58
            size: 1Gbit/s
            capacity: 1Gbit/s
            width: 64 bits
            clock: 33MHz
            capabilities: pm msi pciexpress msix vpd bus_master cap_list ethernet physical tp mii 10bt 10bt-fd 100bt 100bt-fd 1000bt 1000bt-fd autonegotiation
            configuration: autonegotiation=on broadcast=yes driver=r8169 driverversion=2.3LK-NAPI duplex=full firmware=rtl8411-2_0.0.1 07/08/13 ip=192.168.20.38 latency=0 link=yes multicast=yes port=MII speed=1Gbit/s
            resources: irq:131 ioport:e000(size=256) memory:df114000-df114fff memory:df110000-df113fff

---

Questions:

0 Is the TAP 1-0 (see Ref below) the right one for my environment?

Because it's 1000Base-T I think it's suitable for my 1Gigabit network, right?

1 Technically seen, can 100Base-T TAP be used within a 1000Base-T network?

Let's say I want to use the TAP 1-1 (see Ref below) for my 1 Gbit network. Is this possible?

2 Are aggregated TAPs preferable over the non-aggregated ones?

If "you need to monitor both directions of the full-duplex transmissions but your monitoring tool only has one NIC (full duplex aggregation)." (See Ref 3), then you have to use an aggregated TAP.

Is the only purpose of the aggregated and non-aggregated TAPs to meet the (technical) needs of the monitoring device (IPS/IDS)? Does it mean that the hardware of the IPS/IDS itself specifies which TAP to use (IPS/IDS has one NIC -> aggregated TAP; IPS/IDS has two NICS -> non-aggregated TAP)?

3 In regards to the aggregated TAPs VS. full-duplex TAPs: I'm a little bit confused about the terms "bi-directional"/"aggregated"/"full-duplex".

I found a good overview on the site 2 (see Ref below) but I'm still unclear about the technical differences between an aggregated TAP and full-duplex TAP. It says that "A full-duplex TAP is the only option guaranteeing all of the network traffic makes it to the analysis device (including Layer 1 and 2 error information).".

Because the TAP 1-0 (see Ref below) is using a single monitor port I assume that it's classified as aggregated TAP. If all traffic flows over a single cable to a single NIC why is this not seen as full-duplex? Does a full-duplex establish a connection which is capable to transport 100% of the maximum possible network traffic at any moment which would make it the most reliable solution?

4 There are active and passive TAPs as well.

Do I need to care whether to use a passive instead of the active one? Is the passive one preferable for outage-critical environments as explained in 4 (see Ref below) due to no extra powering?

Thank you very much.

KGolbang

---

• Ref 1-0: https://www.dualcomm.com/collections/network-tap/products/dual-link-10-100-1000base-t-network-tap
• Ref 1-1: https://www.dualcomm.com/collections/network-tap/products/usb-powered-10-100base-t-network-tap
• Ref 2: https://observersupport.viavisolutions.com/html_doc/current/index.html#page/ntaps_shared/choosing_between_a_span_aggregator_or_full_duplex_tap.html
• Ref 3: http://www.datacomsystems.com/content/files/19031/intro%20to%20taps%20v4.pdf
• Ref 4: https://insights.profitap.com/passive-vs-active-network-taps

Answer 1

Is the TAP 1-0 (see Ref below) the right one for my environment?

It matches your Ethernet speed. That's the minimum requirement. You have to consider other requirements below.

Technically seen, can 100Base-T TAP be used within a 1000Base-T network?

No. 100Base-T and 1000Base-T are not compatible (unless you want to operate at only 100Base-T)

Is the only purpose of the aggregated and non-aggregated TAPs to meet the (technical) needs of the monitoring device (IPS/IDS)?

That is the main purpose of all TAPs.

Does it mean that the hardware of the IPS/IDS itself specifies which TAP to use (IPS/IDS has one NIC -> aggregated TAP; IPS/IDS has two NICS -> non-aggregated TAP)?

Esentially, Yes.

If all traffic flows over a single cable to a single NIC why is this not seen as full-duplex? Does a full-duplex establish a connection which is capable to transport 100% of the maximum possible network traffic at any moment which would make it the most reliable solution?

Full duplex uses two separate channels, while aggregated combines the two channels into one. Full duplex, therefore, will capture all traffic. Aggregated may lose traffic if each channel is above 50% utilization.

Do I need to care whether to use a passive instead of the active one?

Depends on the reliability and criticality of your network.

Is the passive one preferable for outage-critical environments as explained in 4 (see Ref below) due to no extra powering?

It depends. Some active taps will continue to pass traffic without power, but you will be unable to monitor. Others will fail completely without power. I can't tell from the specs which these are.