CriticalTAP Technology Explained

Being at the forefront of TAP technology means that we at Network Critical have introduced many innovative features to our products that may not yet have gained worldwide familiarity. In the following section, you will find an explanation of many of our technologies and features to give you a better understanding of how each product can assist you in deploying tools across your network.

Fail-to-Safe - Failing to safe is one of the key features of a TAP; since the TAP is physically inserted directly into the network path between two critical devices, the link would go down if the TAP itself were to fail. Consequently, to ensure that the link stays up, each TAP has a number of built-in fail-safe features.  Firstly, we use highly reliable power supply units in all our products; typically these units have an MTBF of around 500,000 hours (more than 50 years). Secondly, many TAP products have a dual supply option to further reduce the possibility of a power failure to the TAP.  Finally, even in the event of a power outage, every TAP also features a fail-safe mechanism on each pair of live network ports: these will automatically default to bypass mode in event of power outage, ensuring that the end devices remain connected.

Zero Packet Loss - This refers to the advanced bypass mode featured on some TAP products. It means that, in the event of a power outage causing failure of the TAP, the end devices remain permanently connected without a single moment of link downtime and without dropping or affecting a single packet. It literally has no affect whatsoever on the condition of the network link. Zero Packet Loss is only available on TAPs for 10/100Mb network speeds and on TAPs without Packet Injection (or TAPs configured to this setup). It is not possible to use Zero Packet Loss at Gigabit Ethernet speed or when Packet Injection is required - in these instances, the TAP exhibits only the normal fail-to-safe mechanism.

Passive - The passive attribute refers to the fact that the TAP has no discernable effect on the network; a passive TAP does not alter the traffic that passes through it and a passive TAP cannot use Packet Injection. In instances where a TAP is being used for monitoring traffic, particularly in stealth mode, a passive TAP is ideal.  In a configurable TAP, the Passive mode is turned off when the Packet Injection feature is turned on.

Packet Injection - Packet injection (PI) is the ability for a TAP to pass packets from the network tool onto the live network link. In instances where a TAP is being used to deploy a content filtering tool or intrusion prevention system, the TAP allows that tool to actively block unwanted content or to stop network attacks.  In a configurable TAP, Packet Injection can be turned off to allow the TAP to operate in Passive mode.

A+B Combi - On a full-duplex network link between two devices (let's call them A and B) traffic flows in both directions simultaneously, from A-to-B and from B-to-A. Combi mode attempts to combine these two traffic flows into a single flow from TAP to tool. As long as the actual combined total of the bi-directional traffic flows on the live link does not exceed the maximum uni-directional capacity of the monitor port on the TAP, then the network tool will see all the traffic. However, if the total of the network traffic exceeds the capability of the monitor port, then the TAP will drop packets on the monitor port.  In this case, it would be necessary to use a higher bandwidth on the monitor port, or to use A/B Breakout mode.

A/B Breakout - Breakout mode uses two monitor ports, each one carrying one of the traffic streams from the full-duplex network link, A-to-B and B-to-A. In this way, the TAP can ensure that not a single packet is dropped, even if the live network link runs at a sustained maximum line-rate.  It requires the attached network tool to have two monitoring interfaces and means that you can be sure that your network tool is seeing 100% of the traffic on the live network.

HA Option - HA (High Availability) is a factory option which can be set for most TAP models.  When in HA mode, there is no thru-connection between the network ports on the TAP; traffic arriving at either network port A or B is forwarded to the monitor ports only and not to the corresponding network port.  This kind of operation is useful when deploying a single network tool into both legs of a parallel hot-standby segment; regular TAPs placed in each network path both feed into an HA TAP which combines the traffic to a single network tool - this stops traffic from one leg being propagated onto the other leg, whilst allowing the network tool to operate fully, even using Packet Injection where required.

One-to-Many - In some instances, you may wish to deploy more than one network tool onto the same link. TAPs with this feature have at least two monitor ports and provide identical copies of the live network traffic onto each port. They could be deployed so that one port is used for a permanently connected security or content management tool, while the other port is left free for ad hoc troubleshooting or network analysis.

Many-to-One - To maximise the ROI of network tools, it may be necessary to deploy a single tool across multiple network links. Many-to-One TAPs can leverage that deployment by aggregating full-duplex network traffic from multiple links into a single interface.