Hello,
Recently I have been interesting in monitoring traffic on my network. I have spent some time researching SPAN and TAPs. Since SPAN mirroring was free, I tried this approach first. This did not turn out so well as I quickly saw CPU and Memory usage spike up on my switch stack (We use Enterasys).
After reading up more on SPAN mirroring I realized this probably isn’t the best solution for my environment due to the performance drawbacks on my network. I also needed something to copy packets from layer one (physical layer) which SPAN port operates I believe at layer 4 or 7. I then began researching network TAPs. I researched the different Network TAPs, Aggregated TAPs, and Intelligent TAPs. Turns out since the line I want to monitor (for now) is the one between my main router and switch. It seems I am only using at max 5Mbs on the line so I believe I can use a 10/100 Port Aggregation device.
I believe I have convinced myself we need to purchase one of these 10/100 Port Aggregation devices, the only problem is I have no idea what is the best vendor for my needs!!! Any input/experiences with other network TAPs would be great.
Also, all the information I have gathered has been from my own personal research. I would be glad to hear other alternatives to good network monitoring of packets. Let me know, thanks!
