Do I need a TAP or SPAN port for network monitoring?
For watching a whole segment, yes, one of the two; for watching specific servers, no, because an agent on each server sees its own traffic. A SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. port is a mirror setting on a managed switch and costs nothing if your switch supports it. A TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. is a small hardware device on a cable, useful when the switch is unmanaged or when you want a copy that never drops packets. Place it where traffic converges, such as the link between your main switch and the router, or the ports of your servers. With NetSenX, one agent on a host connected to a SPAN or TAP port counts as one device for the whole segment, and this is also the way to get packet capture for TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. fingerprinting and the crypto inventory.
Read next
Related questions
- How long does it take to install NetSenX?
- Does network monitoring work if our computers run different operating systems?
- Can network monitoring slow down our network or computers?
- What does a network sensor actually collect: content or metadata?
- Can we start by monitoring only our most critical systems?
Terms used here
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.