TAP or SPAN (RSPAN)
By: Tim O’Neill – The Oldcommguy™
Author’s comments:
- All Rights are reserved – Copyright 2013 by The Oldcommguy™!
- No one may repost this article without receiving permission!
- If permission is given then it must be posted as it is, in full context, WITHOUT any changes!
This is an updated version of my original article that was written in 2007 –
http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html
A Super Video Class from Sharkfest by a world class Trainer and Analyst – Betty DuBois –
http://blip.tv/lovemytool/span-port-vs-tap-by-betty-dubois-2290452
and part of the Ixia Team Blog –
http://blogs.ixiacom.com/ixia-blog/to-span-or-to-tap-that-is-the-question/
The goal of Network, Security, Compliance, and Application managers requires FULL visualization of the Network and the packets therein!
Real Visualization is EVERYTHING!
If you cannot see an issue, like an attack, misusage, inefficiency, etc., then how are you going to understand it and resolve it? Here are the REAL facts about needing REAL TAPs!
Some Fundamental Considerations for REAL Network Visualization Requirements
1) First Consideration of Network Visualization – Any active device that touches a frame has changed the frame timing – even if nothing more than changing its absolute timing reference to the network. The only viable exception is a REAL TAP!
2) Second Consideration of Network Visualization - It is essential to keep all changes by a device, linear. If the frame offset was 10ms then all frames should have the same offset, if not, the device is interfering with the Real Time Analysis Capability of that access point. SPAN access is a great example of variable offset and the impossibility of doing authentic time based analysis from a SPAN/Monitor port. A good TAP with a tested algorithm handles the Send and Receive integration with consistent timing for the best visualization!
3) Third Consideration of Network Visualization – All access devices can change the frame and its environment. Consideration #1 However as long as the company providing it and the operator understands this then one can get relevant data and facts from the devices as long as they do not get into the weak areas of the access device/technology. A TAP is the only reliable access device, see Consideration #4!
4) The Fourth Consideration of Network Visualization – A TAP is the ONLY device that will pass every bit, byte, nibble and octet, including the interframe gap, bad, large, small, and other error packets! Even if one uses a higher technology filtering device I strongly suggest that you stick with using a TAP as your media access. A standalone TAP, not an integrated one! **There is significant debate about the viability of passing bad packets for capture and post capture analysis. I feel that just counting the bad packets/types are acceptable and a requirement for base lining analysis.
5) The Fifth Consideration of Network Visualization - Before one deploys an access technology, one should do two things and study a lot more:
a) Test more than one device to make sure you are getting what you really need for your tools and that you (and your company) can really use the device and the data it provides!
b) Be sure to test the network before and after the access device to compare and get a REAL baseline of the Access device effects on the frames.
c) Always buy QUALITY, my mind jumps to 100% Made and Supported in the U.S.A.
d) No matter the temptation, never mix physical media when using rack mount platforms!
**One major and important consideration about access technology – Please Do Not forget that any access device can be called into question in civil and criminal cases. When using the data captured as the evidence in employee misuse or for CALEA/Lawful capture type situations a TAP is your very best ally, as it just presents the evidence with NO CHANCE of changing anything and with a solid time reference, we call this forensically sound data/evidence and is a MUST for when using for court evidence! Another plus to consider in our security conscious world - a real TAP cannot be hacked so any evidence gathered is as pure as it can get!
To SPAN or to TAP – That is the question!
Until the early 1990’s, using a TAP or test access point from a switch patch panel was the only way to monitor a communications link. Most links were WAN so an adaptor like the V.35 adaptor from Network General or an access balum for a LAN was the only way to access a network. Most LAN analyzers had to join the network to really monitor.
As switches and routers developed, there came a technology we call SPAN/Monitor ports or mirroring ports and now monitoring was off and running. Analyzers and monitors no longer had to be connected to the network directly; engineers would use the SPAN (mirror) port and direct packets from their switch or router to the test device for analysis.
SPAN generally stands for Switch Port for Analysis and was a great way to effortlessly and non-intrusively acquire data for analysis. By definition, a SPAN Port usually indicates the ability to copy traffic from any or all data ports to a single unused port but also usually disallows bidirectional traffic on that port to protect against backflow of traffic into the network. The SPAN or Monitor port was originally a Quality Assurance Test point for their manufacturers and became a visualization access point as an afterthought.
Let’s start with - Is a SPAN port a passive technology – No!
Some call SPAN port a passive data access solution – but passive means “having no effect” and spanning (mirroring) does have measurable effect on the data packets themselves as well as all the packet timing is affected.
Is a SPAN port a scalable technology – No!
When we had only 10Mbps links and with a robust switch (like ones from Cisco) one could almost guarantee they could see every packet going through the switch, except for bad frames. With 10Mbps fully loaded at around 50% to 60% of the maximum bandwidth, the switch backplane could easily replicate every good frame. Even with 100Mbps one could be somewhat successful at acquiring all the good frames for analysis and monitoring and if a frame or two here and there were lost, it was no big problem.
This has all changed with 1, 10 and 40 Gigabit technologies starting with the fact that maximum bandwidth is now twice the base bandwidth – so a Full Duplex (FDX) Gigabit link is now 2 Gigabits of data and a 10 Gigabit FDX link is now 20 Gigabits of potential data flows.
No switch or router can handle replicating/mirroring all this data plus handling its primary job of switching and routing. It is difficult if not impossible to pass all frames (good and bad ones) including FDX traffic at full time rate with the interframe gap, in real time at non-blocking speeds. All this times say 16 ports is a whole lot of data to go through one port!
Furthermore, to this FDX need we must also consider the VLAN complexity and finding the origin of a problem once the frames have been analyzed and a problem detected.
From Cisco’s own White Paper – On SPAN port usability and using the SPAN port for LAN analysis
Cisco warns that “the switch treats SPAN data with a lower priority than regular port-to-port data.” In other words, if any resource under load must choose between passing normal traffic and SPAN data, the SPAN loses and the mirrored frames are arbitrarily discarded. This Consideration applies to preserving network traffic in any situation. For instance, when transporting remote SPAN (RSPAN) traffic through an Inter Switch Link (ISL), which shares the ISL bandwidth with regular network traffic, the network traffic takes priority. If there is not enough capacity for the remote SPAN traffic, the switch drops it. Knowing that the SPAN port arbitrarily drops traffic under specific load conditions, what strategy should users adopt so as not to miss frames? According to Cisco, “the best strategy is to make decisions based on the traffic levels of the configuration and when in doubt to use the SPAN port only for relatively low-throughput situations.”
Please consider that a switch, thus a SPAN access is NOT fault tolerant and can be a major fault or failure point for your monitoring and management vision. A real TAP is not a failure point!
Today’s “REAL” Data Access requirements
To add more complexity and challenges to SPAN port as a data access technology,
1) We have entered a much higher utilization environment with many times more frames in the network
2) We have moved from 10 Mbps to 40 Gbps Full Duplex and
3) We have entered into the era of Data Security, Deep Capture, Legal and policy Compliance, network auditing and Lawful Intercept (CALEA) which requires that we must monitor all of the data and not just “sample” the data, with the exception of certain very focused monitoring technologies (e.g., application performance monitoring).
These demands will continue to grow since we have become a very digitally focused society. Especially with the advent of VoIP and digital video we now have revenue generating data that is connection oriented and sensitive to bandwidth, loss and delay. The older methods need reviewing and the aforementioned added complexity requires that we change some of the old habits to allow for “real” 100% Full Duplex real time access to the critical data.
In summary, being able to provide “real” access is not only important for Data Compliance Audits and Lawful Intercept events, it is the law (keeping our bosses out of jail has become very high priority these days).
When is SPAN port methodology “OK”?
Many monitoring products can and do successfully use SPAN as an access technology. These monitoring products are looking for low bandwidth application layer events like “conversation or connection analysis”, “application flows”, and applications where real time and knowing real delta times are not important.
These monitoring requirements utilize a small amount of bandwidth and grooming does not affect the quality of the reports and statistics. The reason for their success is that they keep within the parameters and capability of the SPAN ports capability and they do not need every frame for their successful reporting and analysis. In other words, SPAN port is a usable technology if used correctly and the companies that use mirroring or SPAN are using it in a well-managed and tested methodology.
Conclusion
Spanning (mirroring) technology is still viable for some limited situations but as one migrates to FDX from Gigabit to 40 Gigabit networks and with the demands of seeing all frames for Data Security and policy Compliance, deep capture and Lawful Intercept one must use “real” access (TAPs) technology to fulfill the demands of today’s complex analysis and monitoring technologies.
If the technology demands are not enough, the network engineers can focus their infrastructure equipment on switching and routing and not spend their valuable resources and time setting up span ports or rerouting data access.
In summary, the advantages of TAPs compared to SPAN ports are:
- TAPs do not alter the time relationships of frames – spacing and response times especially important with VoIP and Triple Play analysis including FDX analysis.
- TAPs do not introduce any additional jitter or distortion which is important in VoIP / Video analysis.
- TAPs are TIMELESS – They never need to down load or be upgraded, they do not have access to anything except the LAN they are monitoring!
- TAPs pass VLAN tags but are not passed through a SPAN port so this can lead to false issues being detected and difficulty in finding VLAN issues.
- TAPs do not groom data, packet timing nor filter out errored packets
- TAPs pass ALL frames - including Short or large frames
- TAPs pass ALL frames including Bad CRC frames
- TAPs even pass the interframe gap - 12 octets - The interframe gap is not dropped nor altered
- TAPs do not drop packets regardless of the bandwidth
- TAPs are not addressable network devices and therefore cannot be hacked – High Security!
- TAPs have no setups or command line issues so getting all the data is assured and saves users any setup time.
- TAPs are Plug and Monitor 100% of the time
- TAPs are completely passive and do not cause any distortion even on FDX and full bandwidth networks.
- TAPs are fault tolerant.
- TAPs do not care if the traffic is IPv4 or IPv6, it passes all traffic through
- TAPs DO NOT have any FILTER setup, that is a marketing name for a SPAN device called a TAP, but is not a REAL TAP!
Anyway you analyze it, TAPs are the ONLY REAL 100% Network Access Technology!
Every network should have TAPs to access and pass on the data! TAPs pass ALL the data not just part of it.
Question: We purchase glasses so we can see clearly, why would we pay for glasses if they distorted our view?
I and my expert network analysts use Garland Technology LLC for REAL TAP/Visualization Solutions. www.garlandtechnology.com
RSPAN – If SPAN is not the best access technology, now RSPAN which is SPAN from another switch in your network where packets from a remote switch are now passed through the network to another switch or switches for access or visualization through a local SPAN port. RSPAN is NOT a viable access technology especially if the packets are passed over the WAN as it will gobble up all you bandwidth passing frames back to your local switch that have already passed through the network.
RSPAN is Not anywhere near an acceptable nor viable visualization access method except for VERY rare and short time needs!
Copyright® BT Solutions and Oldcommguy® 2013 All Rights Reserved
If you cannot see it, then how can you fix it?