12/19/2006 Enterprise IT Planet: by Dan Ragle
Network Instruments nTAPs
Network Instruments nTAPs are TAPs that can be inserted into the network flow and provide network monitoring capabilities. New to the Network Instruments nTAP line are their Aggregator nTAPs, which combine the traffic from both sides of the network link and send that combined flow to the analysis device(s).

Network Instruments nTAPs

Network Instruments nTAPs are TAPs that can be inserted into the network flow and provide network monitoring capabilities. Three nTAPs can be deployed side-by-side in a single rack; or can be optionally individually mounted in a drive bay.

Familiar especially to traffic monitoring needs (including many security devices, such as intrusion detection or content monitoring appliances), a network TAP is inserted into the network flow and transparently replicates or splits the network traffic, sending a copy to the analyzer appliance or other monitoring gear. The actual network traffic is unaltered in the process; the TAPs just provide a means to peek at the traffic traveling over the line. Therefore, once the TAP is deployed in the network, the analysis gear can be attached to it (the TAP) without disrupting network traffic flows. Security devices such as those mentioned above are often deployed by hanging them off a network TAP.

Network Instruments' nTAP line, in particular, are offered in multiple flavors, supporting copper, fiber, or copper-to-fiber network conversions. As described above, once installed the TAPs operate invisibly to the network, as they do not require an address. Additionally, the nTAPs support the use of redundant links on connected devices; i.e., the TAP monitors both sides of the traffic connection, and if the link on one side fails, the TAP brings down the other side as well--so that the connecting device can correctly sense the problematic connection and switch to its redundant link is so enabled. If power fails to the nTAP, the traffic continues to flow directly through the A/B links; and each of the copper nTAPs allows for connecting redundant power.

In the case of the copper TAPs, the signal is replicated and sent to the other side of the network link as well as to the analysis device; and in the case of the Fiber TAPs the signal is split via one of several user-selectable ratios; including 50/50, 60/40, 70/30, 80/20, and 90/10.

For the copper TAPs, two models are currently offered, supporting 10/100 and 10/100/1000 (with auto-negotiation) network connections. Both contain a total of four RJ45 ports: two for the A/B side of the network link, and two that send the respective A/B traffic to the receiving device for analysis (that device therefore requires a dual-port interface). A third copper TAP provides copper-to-fiber conversions; where the network links remain copper but the analysis device can be connected via either copper ports or a fiber port (both analysis ports cannot be used simultaneously). The optical port is SFP, supporting SX, LX (Multimode or Single-mode), or ZX interfaces (all via LC connectors).

The fiber nTAPs, which require no separate power connections for operation, are offered supporting one, two, or three network links (and one, two, or three analyzer ports to match the respective network links) and all feature LC connectors. All can be configured to handle Gb single-mode, Gb multimode, or 10 Gb multimode traffic.

New to the Network Instruments nTAP line are their Aggregator nTAPs, which combine the traffic from both sides of the network link and send that combined flow to the analysis device(s). The Aggregator nTAPs boast a single buffer that pools traffic from both the send and receive sides of the link; this buffer is available in 256 or 512 MB offerings. The Aggregator nTAPs support 10, 100, or 1000 Mb traffic. Like the other copper nTAPs, the aggregator is also offered in a copper-to-fiber conversion option. Also like the other copper nTAPs, the Aggregator nTAPs include four ports, two for the A/B network link, and two for the monitoring devices. However, in the case of the Aggregator nTAPs, the ports to the security devices both contain the combined A/B traffic; thus two security devices can be used with the TAP each with only a single-receive capture interfaces (recall that the other nTAPs in the line all require the receiving device to have dual-receive capture cards).

The new Aggregator nTAPs are priced at $1,495 (256 MB) and $1,995 (512 MB); the copper-to-fiber converter is listed as starting at $1,795. Pricing for the remaining nTAPs ranges from $295 (one-channel Fiber) to $1,495 (copper-to-fiber converter).

The Aggregator nTAPs are expected to ship in January.

Contact Network Instruments for further information.