I will be setting up a passive optical tap on a 10gig fiber line (OM3 50/125 multimode 850nm), and passing the two fiber cables from the monitor port to a linux server that will have an IDS (Snort or Suricata).
I have most things sorted out, but my problem is that IDS's don't function well (or at all) when traffic is split between two interfaces and especially at 10 gigabit speeds. Which is an issue because a passive tap is my requirement to keep the link as reliable and performant as possible.
I was thinking, since the tap creates two single fiber lines, why are there no SFP+ Modules that have two receiver inputs? Or PCIe cards that have two LC connectors that appear as a single interface to the host OS?
For hardware, this seems like something very possible (can't find anything on google), so there must be something I'm missing for why this isn't a thing. Is the firmware on the module and network card impossible to deal with two inputs for the same (connection) network traffic? It seems to me this type of physical layout would already occur with multiple conductive pairs in regular ethernet cable.
Do other environments only use these optical taps to analyze one direction at a time?
Am I missing some other way to economically combine two transmitting fibers into one interface? (Other than trying to use software bridging)