Agent-based or SPAN/TAP-based network monitoring: which is better?
A mirror port or tap is usually better for a whole office segment, and agents are better for specific servers or places where you cannot mirror traffic. With SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. (a switch setting that copies traffic to one port) or a TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. (a small device that copies traffic on a cable), one sensor sees every device on the segment, including printers, cameras and machines, without installing anything on them. It needs a managed switch or a tap, and it only sees the segments you mirror. An agent on a host sees that host's own traffic wherever it is, including servers in a data centre or cloud where you cannot mirror anything. Many companies combine the two. NetSenX supports both: an agent on a SPAN or TAP port counts as one device for the whole segment, and agents run on Linux and macOS. TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. fingerprinting needs packet capture, which the basic macOS mode does not do.
Read next
Related questions
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.