|
A network tap is a hardware device which provides a way to access the data flowing across a computer network. In many cases, it is desirable for a third party to monitor the traffic between two points in the network. If the network between points A and B consists of a physical cable, a "network tap" may be the best way to accomplish this monitoring. The network tap has (at least) three ports: an A port, a B port, and a monitor port. A tap inserted between A and B passes all traffic through unimpeded, but also copies that same data to its monitor port, enabling a third party to listen. Network taps are commonly used for network intrusion detection systems, VoIP recording, network probes, RMON probes, packet sniffers, and other monitoring and collection devices and software that require access to a network segment. Taps are used in security applications because they are non-obtrusive, are not detectable on the network (having no physical or logical address), can deal with full-duplex and non-shared networks, and will usually ''pass through'' traffic even if the tap stops working or loses power. == Terminology == The term network tap is analogous to phone tap or vampire tap. Some vendors have phrases for which tap is an acronym; however, those are most likely bacronyms. The monitored traffic is sometimes referred to as the ''pass-through'' traffic, while the ports that are used for monitoring are the ''monitor'' ports. There may also be an aggregation port for full-duplex traffic, wherein the "A" traffic is aggregated with the "B" traffic, resulting in one stream of data /packets for monitoring the full-duplex communication. The packets must be aligned into a single stream using a time-of-arrival algorithm. Vendors will tend to use terms in their marketing such as ''breakout'', ''passive'', ''aggregating'', ''regeneration'', ''inline power'', and others. Common meanings will be discussed later. Unfortunately, vendors do not use such terms consistently. Before buying any product it is important to understand the available features, and check with vendors or read the product literature closely to figure out how marketing terms correspond to reality. All of the "vendor terms" are common within the industry and have real definitions and are valuable points of consideration when buying a tap device. A distributed tap is a set of network taps which report to a centralized monitoring system or packet analyzer. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「network tap」の詳細全文を読む スポンサード リンク
|