What is an inline tap in networking?

Chris Bihary

Chris Bihary

Published Jul 30, 2019

Despite being in the technology industry, there are some things system security pros (or their bosses) just aren't familiar with. One of the questions we get at Garland is, "What is a network TAP, anyway?" The next question is typically, "And why do I need one?" 

In our mission to education the networking and security industry, here's a good overview of network TAPs that will answer those questions.

Network Test Access Point (TAP) Defined

A network TAP is a hardware tool that allows you to access and monitor your network. TAPs transmit both the send and receive data streams simultaneously on separate dedicated channels, ensuring all data arrives at the monitoring device in real time.

Deciding how to get data from your network and into your monitoring and security tools is just as important as the tools themselves. Network TAPs are the industry best practice - and the only guaranteed method for 100% data capture.

How Do Network TAPs Work?

Network TAPs are inserted between network devices, like a switch and router, where they copy data continuously, 24/7, without compromising network integrity. Different types of network TAPs are used depending on the needs of the monitoring and security tools they are feeding traffic into.

Network TAPs come in variety of forms and configurations:

• Passive TAPs: Support out-of-band, "listen-only" devices used for monitoring tools, and are simple, reliable, and require no power.
• Active TAPs: Support inline devices used for security applications and include bypass or failsafe technology.
• Various media types, copper or fiber (LC, MTP/MPO, BiDi), and can perform Media Conversion
• Various speeds from 10/100/1000M all the way to 100G
• Various form factors including portable, 1/2 U, 1U and 2U Chassis solutions

Each type of network TAP operates in a slightly different manner based on the requirements it needs to perform. In our Primer on Network TAPs, I reviewed the different functions and benefits to using each TAP mode.

Here's a quick overview of the different TAP modes:

• Breakout "Normal" TAPs: Ensure that no packet is lost to high-priority monitoring tools
• Filtering TAPs: Allow you to set rules on what data is filtered and sent to monitoring or security tools. Filtering prevents ports from becoming oversubscribed
• Aggregation TAPs: Merge traffic streams into one monitoring port to reduce appliance costs, often used in combination with filtering TAPs, ie: filter, aggregate data streams 
• Regeneration/SPAN TAPs: Create multiple copies of network data to support multiple devices from a single connectivity point
• Bypass TAPs: Prevents inline devices from causing network downtime if they fail or need to be updated.

What's the Alternative to a Network TAP?

Well, when I started out in this industry - we connected to the live wire. But back then there wasn't another option. Some engineers started using the SPAN/Mirror port on their switches - but that leads to an entire quandary of data quality issues, such as dropped packets, altered packets, etc. Read more about the differences of network TAPs vs. SPAN ports.

The advantages of using a network TAP are:

• TAPs receive all of the data - including jumbo frames and errors
• TAPs do not cause network delays, latency or timing issues
• TAPs do not alter the time relationships of frames, spacing and response times
• TAPs are court approved for CALEA and lawful intercept cases
• TAPS don't have an IP or Mac address and cannot be hacked

The advantages of a Garland Network TAP:

• The Garland Quality Standard: All TAPs are tested and verified with live data before leaving our manufacturing facility, proving to be the industry's most reliable TAP with zero failures
• Made, supported and serviced in Richardson, Texas
• Fully committed to supporting the wire, Network TAPs available in 10/100M, 10/100/1000M Copper and 1G, 10G, 40G, and 100G Fiber

Read our eBook, Network TAPs 101 - The Networking User Guide, where we discuss the connectivity strategy of the various TAP modes, as well as environmental considerations such as passive or active, and media conversion.