I want to buy a TAP but I'm uncertain which device is the right one for my environment. The command
sudo lshw shows the following about my Ethernet:
*-network description: Ethernet interface product: RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller vendor: Realtek Semiconductor Co., Ltd. physical id: 0.1 bus info: pci@0000:03:00.1 logical name: enp3s0f1 version: 12 serial: 80:fa:5b:3b:de:58 size: 1Gbit/s capacity: 1Gbit/s width: 64 bits clock: 33MHz capabilities: pm msi pciexpress msix vpd bus_master cap_list ethernet physical tp mii 10bt 10bt-fd 100bt 100bt-fd 1000bt 1000bt-fd autonegotiation configuration: autonegotiation=on broadcast=yes driver=r8169 driverversion=2.3LK-NAPI duplex=full firmware=rtl8411-2_0.0.1 07/08/13 ip=192.168.20.38 latency=0 link=yes multicast=yes port=MII speed=1Gbit/s resources: irq:131 ioport:e000(size=256) memory:df114000-df114fff memory:df110000-df113fff
0 Is the TAP 1-0 (see Ref below) the right one for my environment?
Because it's 1000Base-T I think it's suitable for my 1Gigabit network, right?
1 Technically seen, can 100Base-T TAP be used within a 1000Base-T network?
Let's say I want to use the TAP 1-1 (see Ref below) for my 1 Gbit network. Is this possible?
2 Are aggregated TAPs preferable over the non-aggregated ones?
If "you need to monitor both directions of the full-duplex transmissions but your monitoring tool only has one NIC (full duplex aggregation)." (See Ref 3), then you have to use an aggregated TAP.
Is the only purpose of the aggregated and non-aggregated TAPs to meet the (technical) needs of the monitoring device (IPS/IDS)? Does it mean that the hardware of the IPS/IDS itself specifies which TAP to use (IPS/IDS has one NIC -> aggregated TAP; IPS/IDS has two NICS -> non-aggregated TAP)?
3 In regards to the aggregated TAPs VS. full-duplex TAPs: I'm a little bit confused about the terms "bi-directional"/"aggregated"/"full-duplex".
I found a good overview on the site 2 (see Ref below) but I'm still unclear about the technical differences between an aggregated TAP and full-duplex TAP. It says that "A full-duplex TAP is the only option guaranteeing all of the network traffic makes it to the analysis device (including Layer 1 and 2 error information).".
Because the TAP 1-0 (see Ref below) is using a single monitor port I assume that it's classified as aggregated TAP. If all traffic flows over a single cable to a single NIC why is this not seen as full-duplex? Does a full-duplex establish a connection which is capable to transport 100% of the maximum possible network traffic at any moment which would make it the most reliable solution?
4 There are active and passive TAPs as well.
Do I need to care whether to use a passive instead of the active one? Is the passive one preferable for outage-critical environments as explained in 4 (see Ref below) due to no extra powering?
Thank you very much.
- Ref 1-0: https://www.dualcomm.com/collections/network-tap/products/dual-link-10-100-1000base-t-network-tap
- Ref 1-1: https://www.dualcomm.com/collections/network-tap/products/usb-powered-10-100base-t-network-tap
- Ref 2: https://observersupport.viavisolutions.com/html_doc/current/index.html#page/ntaps_shared/choosing_between_a_span_aggregator_or_full_duplex_tap.html
- Ref 3: http://www.datacomsystems.com/content/files/19031/intro%20to%20taps%20v4.pdf
- Ref 4: https://insights.profitap.com/passive-vs-active-network-taps