When you are in the middle of a network crisis you need somethingthat is handy, quick to deploy, fast to resolve, and yet powerfulenough to counter the crisis. Network problems and security issues
can erupt at any time. Especially when you least expect it. You don’t
want to deal with additional complexities or inaccuracies right at themoment when you already have a problem on your head to sort out.
Having network TAPs with you is one of the best ways to analyse
your network for issues. And having a portable TAP is the best andfastest way to dive right into your network, parse the traffic and gethold of the packets creating all the trouble at the time of crisis.
But not all portable TAPs are as good as they sound. Some of themare powerful but complex as well to handle. Some of them are easy
to deploy but not powerful enough to handle the traffic fully. A
portable TAP that is powerful enough to take on the full traffic, andyet easy to deploy on the field fast enough, is the right tool to have.
Before we introduce you to this right tool, let’s first have a look atother portable TAPs available in the market and why they lag behind.

1Some manufacturers have introduced abasic version, small enough to cater just
one network link, of their full-duplex
TAPs and market it as a portable model.
The funny thing is that they are justsmaller versions of their rack-mountmodels and still contain rack-mountscrew holders. More of a desktop version
you can say. Being a full-duplex TAP, it
does capture the traffic at full line-rate
without any packet loss or timing delay.
No doubt about that. But it comes at the cost of needing additional resources.
And because of this an IT engineer would find it hard to carry around this so-called
portable TAP on the field.
A full-duplex TAP, also known as a Breakout TAP, captures traffic streams from two
network ports and copies them onto two ‘output’ or monitoring ports. This iswhere the complexity pops up. To utilise a full-duplex TAP you also need to have alunch-box PC containing dual network-interface cards (NIC). On top of that, the PC
hosting the monitoring application would also have to perform interface-bondingor link-aggregation to ‘see’ the two interfaces as one single flow of traffic stream.

Figure 1: Schematic illustration of a Full-duplex TAP

2This means double the resources, double the cost, and double the time required
to hit the ground running. Let’s accept it – you can’t carry a desktop around infield locations, and you don’t have dual NICs in your laptop as well. (How many
companies can afford to dish out dual-NIC high-performance laptops to theirfield staff any way?)
Well, there goes the portability of your network TAP then.

Another way TAP manufacturers went on
to address the resource complexity offull-duplex TAPs was by introducing
Aggregator TAPs. As the name reveals, anAggregator TAP combines the two
incoming traffic streams into a single
flow of outgoing traffic. Hence there is asingle monitoring port which receives theaggregated traffic of both network ports.
This resolves the requirement of having dual NICs in the analysis PC. In fact itdoes away with the need of having a lunch-box PC in the first place, making way
for your laptop to be easily connected to the TAP. Here comes the portability atlast, but at the cost of giving away performance. If the input and output ports ina TAP are of the same data rate then this could become a source of problem
itself. For all practicality, we all know that network trunks today are of Gigabit rate
(1 Gbps) at least. So to troubleshoot any of your network trunks, you would placea TAP having Gigabit network ports. And this is where the performance problem
starts. If the output or monitoring port is also a Gigabit port, then it is notpossible to completely transport 2 Gbps of combined traffic stream over a 1Gbps
output. This means something has to be compromised.
Aggregator TAPs use an internal buffer to aggregate the traffic and to cache theincoming packets to keep up with the speed of the output port. But it depends
on the size of the buffer as to how long can it sustain the flow of incoming
packets before starting to drop them.

3

Figure 2: Schematic illustration of an Aggregation TAP

As soon as the network interface utilisation shoots beyond 50%, and the buffer isfull, your precious packets would start to fall off the bridge. And as much as 50%of the total traffic could be lost if both the input network ports throttle traffic at
its full capacity. Some aggregator TAPs have more memory to absorb data bursts,
but it comes at the cost of a significant effect on packet timing which is notsuitable at all for analysing real-time protocols.
The best way to overcome this bottleneck is to transport the aggregated traffic
to a higher data rate output. But it would not be feasible for TAP manufacturers
to use a 10GE NIC as an output in a portable TAP. Plus, laptops are not going tohave 10GE NICs anywhere in the near future. The entire point is to haveportability and performance packed into one small kit.

4

The entire purpose of installing a TAP on your

When it comes to troubleshooting a network

network is to have the ability to capture &or application issue, or performing security

analyse each and every packet. How can you

forensics, nothing beats the ability to see

leverage the full potential of your monitoring ordata in real-time. During a network crisis, thesecurity application if it does not receive some

network and system teams resort to theirof the packets in the first place? Sure it is still

usual blame game in the absence of any

going to receive some traffic. But what if thecorrelation between network and server data

critical packets, e.g. the ones containing thethat matches packet to packet response

application layer problem identifiers or atimes. Having a monitoring application that is

network intruder’s signature, do not reach yourable to correlate the packets in real-time as it

analyser at all?

happens on the network is the key toensuring timely resolution of problems.

Some IT users seem to be settled with the factthat it is fine if a small number of packets (e.g.

Similarly, the difference between getting

10-20%) is not captured by their analyser. And

busted with a network penetration versus

that is where their practice is flawed. When it

preventing the security issue in the first placecomes to traffic monitoring & analysis, youis being able to detect & identify threats as it

simply cannot afford to miss out any packet. On

happens in real-time. Thus, the ability to

top of that, analysers would not be able tocapture packets from your traffic in real-timereconstruct actual network flows if there areis a key factor to benefit from having a TAP

packets missing in between. Thus they cannotonshow the true picture of what is happening on

incorrectly timed packets, makes you lag

your network. And if you’re not able to see thebehind in effectively identifying problems intrue picture, then your entire investment inyour network in spite of having a TAP.

yournetwork.

Delayeddelivery,having a TAP goes to waste.

5orIn comes the world’s best, fastest and truly portable network TAP ready to hit theground running for any kind of troubleshooting in any field location.
ProfiShark 1G is pocket-sized and yet power-packed. It works as anaggregator TAP but without the bottleneck of any packet drop or time delay.
With its two Gigabit network ports, it easily combines the two traffic streams totransport over a single monitoring port. And it does not use a Gigabit NIC as
the monitoring port. Instead, it utilises the power of USB 3.0.
USB 3.0 is the third major revision of the Universal Serial Bus standard that uses anew transfer mode, SuperSpeed, which can transfer data at up to 5 Gbps. Henceit can easily transport 2 Gbps of aggregated traffic stream (1G each from ports Aand B) over a USB 3.0 link. This means that the buffer memory doesn’t need todrop any packets and doesn’t have to store packets long enough to impact itstiming.
6

Figure 3: Schematic illustration of a ProfiShark 1G TAP

And because it can easily connect to your laptop’s USB port, the best part of theplug-&-play ProfiShark 1G is that it is not dependent on an external
power source. Combined with a laptop, you have a truly portable andpowerful troubleshooting kit ready to use at any location without depending
on a power source.
The ProfiShark 1G captures packets and transfers directly to any host computer’s
disk. All packets are captured in real-time with nanosecond time-stamping at
hardware level on each packet as it enters the TAP. This allows real-time protocol
analysis of captured traffic with nanosecond resolution.
Plus, it has the ability to capture any
type of frame, be it VLAN, VXLAN,MPLS, etc., between 10 bytes and 10Kilobytes. It also captures low level
error frames, e.g. CRC errors, whichmakes it a perfect tool to perform
troubleshooting at the lowest level aswell. On top of that, ProfiShark 1G
is PoE (Power over Ethernet) compliant
as well, allowing the network links
to transport
powertothenetwork equipments without any
hindrance.

7

Book a date with the ProfiShark 1G
Please feel free to contact us to try a demo of theworld’s best and truly portable network TAP.

+31 (0) 40 782 0880