TAP or SPAN / RSPAN
Two different solutions are available to analyse the trafic coming from the equipments deployed to monitor the traffic.
1. technical architecture embedding passive TAP directly inserted on the link
2. use of the technical features embedded within the production equipments by CLI instructions
This document analyse the two methods, the advantages and
the desadvantages :
COMPARATIVE TECHNICAL SHEET
Two different technical ways to copy the trafic :
1. Port mirroring - SPAN port
1. simple to activate: just need to use the proper command proposing by the vendors of the active equipment
2. doesn't need to interrupt the production.
3. can be realised remotely without needing to go on site
1. use the CPU of the active equipment used for production.
2. SPAN functionalities are not critical functionalities for production. In case of dysfunction, SPAN functionalities will be not priotiy. Packets will be dropped.
3. in case of SPAN of many ports to a single monitoring port, the sum of the global throughput can exceed the throughput of the monitoring port. Packets will be dropped.