Network tap

A Network TAP (Terminal Access Point) denotes a system which monitors events on a local network and in order to aid administrators (or attackers) in analyzing the network.[1] The tap itself is typically a dedicated hardware device, which provides a way to access the data flowing across a computer network. In many cases, it is desirable for a third party to monitor the traffic between two points in the network. If the network between points A and B consists of a physical cable, a "network tap" may be the best way to accomplish this monitoring. The network tap has (at least) three ports: an A port, a B port, and a monitor port. A tap inserted between A and B passes all traffic (send and receive data streams) through unimpeded in real time, but also copies that same data to its monitor port, enabling a third party to listen. Network taps are commonly used for network intrusion detection systems, VoIP recording, network probes, RMON probes, packet sniffers, and other monitoring and collection devices and software that require access to a network segment. Taps are used in security applications because they are non-obtrusive, are not detectable on the network (having no physical or logical address), can deal with full-duplex and non-shared networks, and will usually pass through or bypass traffic even if the tap stops working or loses power.

Tapping technology methods

There are various methods for getting access to the network. Many tapping methods can be used, according to the network technology and the monitoring objective. The first method, when a monitoring device is installed in-line. When a monitoring device is installed in-line, the network will stop every time the device is updated or rebooted. Similarly, if the device failed, the network would break down as well.[1] Another method to monitor networks is by enabling Promiscuous Mode on the host that is used for the monitoring and attaching it to a network switch. This method works well with old LAN technologies. However, modern network are usually switched based networks, meaning the devices are communicated using Point-To-Point links. If the monitoring device is connected to such a network, it will only see its own traffic, so it is hard for other devices to see the traffic. Some of the traditional methods for gaining access to the network traffic use a SPAN port, also known as MIRROR port, in the switch. This is a software method for network tapping and places less load on the network switch. This is a low-cost alternative to traditional network tap methods. However, not all routers and switches support port mirroring and, on those that do, using port mirroring can affect the performance of the router or the switch.

Often, when the SPAN port is overloaded, packets will be dropped before reaching the monitoring device. There is also the possibility of losing some of the error packets that may be causing problems. If this data is not sent to the monitoring device because it is dropped, it is impossible to troubleshoot, no matter how advanced a device that may be used. All of these problems can be solved by using a Tapping system. The Tapping will guarantee that every packet is being sent from the network to the monitoring device. It always passes every packet, even error packets that a SPAN port may drop, to the monitoring device. V-Line Tapping is the most important Tapping system methods. V-Line Tapping (also known as In-line or Bypass Tapping) allows placing the served system virtually in-line. When putting this device in-line will compromise the integrity of a critical network. By placing a Tapping system instead of the monitoring device and connecting the monitoring de-vice to the Tapping system, it can guarantee that the net-work will continue to flow and the device will not create a failure point in the network.[1]

Terminology

The term network tap is analogous to phone tap or vampire tap. Some vendors have phrases for which tap is an acronym; however, those are most likely bacronyms.

The monitored traffic is sometimes referred to as the pass-through traffic, while the ports that are used for monitoring are the monitor ports. There may also be an aggregation port for full-duplex traffic, wherein the "A" traffic is aggregated with the "B" traffic, resulting in one stream of data /packets for monitoring the full-duplex communication. The packets must be aligned into a single stream using a time-of-arrival algorithm.

Vendors will tend to use terms in their marketing such as breakout, passive, aggregating, regeneration, bypass, active, inline power, and others. Common meanings will be discussed later. Unfortunately, vendors do not use such terms consistently. Before buying any product it is important to understand the available features, and check with vendors or read the product literature closely to figure out how marketing terms correspond to reality. All of the "vendor terms" are common within the industry and have real definitions and are valuable points of consideration when buying a tap device.

A distributed tap is a set of network taps which report to a centralized monitoring system or packet analyzer.

Infrastructure TAPs and the need for a comprehensive visibility system

In order to achieve a 100% guaranteed view of all network traffic and fulfil today’s access and visibility requirements, the network infrastructure must incorporate network TAPs. Network Visibility solutions are only as good as the data that they receive; Network TAPs represent the foundation of an effective and reliable visibility infrastructure. The question that follows is, naturally, what exactly is a Network TAP and what does it offer that makes it a more effective data source than alternatives such as Port Mirroring and SPAN (Cisco’s Switched Port Analyzer)?

Tim O’Neill, the technology consultant and Chief Contributing Editor of lovemytool.com has published an in-depth article comparing and contrasting the differences between a SPAN port and a Network TAP; the article can be found here: http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html. In this article, Tim provides compelling reasons to use Network TAPs for meeting today’s network visibility requirements. I will briefly point out below some of the key advantages a Network TAP has over a Port Mirroring or SPAN technology (I will use the term SPAN to generically describe these technologies for the rest of the paper) without reiterating everything the article states, and I highly encourage you to read it.

What is a Network TAP?

A Network TAP is a relatively simple OSI Layer 1 device (simplicity equals reliability in this case) that connects directly inline with the cabling infrastructure and creates a copy of the traffic for monitoring purposes. They can be standalone devices or can be integrated into a visibility node. The copied traffic has no impact or interaction with the live network, and it is not possible to send traffic from a TAP’s monitoring ports back into the live network stream. In fact, TAPs, except for Aggregation TAPs, are unmanaged devices and do not represent a risk of compromise as they cannot be enumerated in a network scan or remotely accessed (This speaks primarily to Cubro’s TAP lineup).

With respect to fault tolerance, fiberoptic TAPs are completely passive devices requiring no power and completely fail-safe in operation. 10/100 copper TAPs require power only for the monitor ports while the live link remains passive and fail-safe. 10/100/1000 copper TAPs require some additional PHY level intelligence and, historically, relied on relays to fail open in the case of a power failure which could interrupt the link and require an auto-negotiation process between the two endpoints. Cubro has pioneered a new 10/100/1000 TAP architecture that reduces this problem and further enhances the reliability of 1 Gbps copper TAPs. The way these devices operate is fundamentally different from a SPAN port because the Network TAP performs only a singular function and requires no processing capabilities to forward the copied traffic for monitoring. A SPAN is an ancillary function to the primary purpose of the switch. Performing that function requires additional processing resources and, by design, a switch will interrupt the traffic forwarding of the SPAN to protect its primary function of packet switching.

The TAP does not alter the traffic in any way or introduce any latency, furthermore, the copy is an exact duplicate of what is being carried on the link. In contrast to the way a SPAN works, the TAP does not require any configuration for traffic to be copied. Whereas a SPAN will drop errored or malformed frames a TAP will not. Additionally, a SPAN will alter the timing of the forwarded traffic such that it no longer reflects the reality of the network; a TAP is a precise reflection of what is on the wire.

A final consideration is the potential for oversubscription. In the case of full duplex links, the overall bandwidth of the link is actually twice the rated speed of the link i.e. a 1 Gbps link is capable of up to 1 Gbps on the transmit (TX) side and up to 1 Gbps on the receive (RX) side and thus contains, potentially, 2 Gbps of traffic. If you send the traffic from a 1G full duplex link to a SPAN, then you are potentially directing up to 2 Gbps of data to be sent out on a port that can only handle 1 Gbps; that means a lot of lost packets. On a TAP there will be a separate monitor port for TX traffic and RX traffic. In the case of a copper TAP that means the ports you are transmitting the copied traffic from, and likewise to, are capable of the same throughput as the live link. If a situation were to oversubscribe the links on a copper TAP, it would have already oversubscribed the live link, and the point becomes moot. An optical TAP cannot be oversubscribed in any case.

All these considerations taken together mean that a monitoring system that relies on SPAN ports for data feeds cannot be counted as 100% reliable; in the best-case scenario it doesn’t completely reflect the network traffic accurately and in the worst-case scenario it can be missing vital information that is key to detecting a network issue. [2]

New filterable tap technology

A new type of tap, or network access point, is available. This new type of tap is called a "filterable" tap. It is especially valuable in the 1 Gigabit and 10 Gigabit environment to save budget and avoid unnecessary tool upgrades. Some taps, like those from several vendors, offer the ability to utilize less expensive and more widely available 1-Gigabit monitoring and analysis tools with these 10 Gigabit networks. When used in this fashion, some form of load-balancing or filtering is recommended to avoid packet loss to the monitoring tools.

A filterable tap, that provides advanced filtering, can selectively pass data, based on application, VLAN ID, or other parameters, to the 1-Gigabit port for deep analysis and monitoring, including IDS requirements.

Filtered access is also the best way to focus on business-critical traffic, or other specific areas of your network. At higher speeds, network traffic analysis cannot be performed using the older "capture and decode everything" philosophy. In this type of environment, focused access is the best way to enable traffic analysis, and often is the only way.

Any filterable tap you consider must have a simple user interface for easy setup and management, such as a CLI or GUI. Furthermore, it must be able to collect the Layer 1 and Layer 2 data, while still allowing for auto saving, and easy access to data by graphing programs. Such a tap can be part of a strategy to monitor for essential metrics, such as frame errors and corrupted frames in IPv6.

Advantages and features

Older network technologies tended to be shared. Connecting a monitoring device to a shared network segment (i.e., piece of a network) was very easy—just connect the monitoring device as you would any other host, and enable promiscuous mode. Modern network technologies tend to be switched, meaning that devices are connected using point-to-point links. If a monitoring device is connected to such a network, it will only see its own traffic. The network tap allows the monitoring device to view the contents of a point-to-point link.

Modern network technologies are often full-duplex, meaning that data can travel in both directions at the same time. If a network link allows 100 Mbit/s of data to flow in each direction at the same time, this means that the network really allows 200 Mbit/s of aggregate throughput. This can present a problem for monitoring technologies if they have only one monitor port. Therefore, network taps for full-duplex technologies usually have two monitor ports, one for each half of the connection. The listener must use channel bonding or link aggregation to merge the two connections into one aggregate interface to see both halves of the traffic. Other monitoring technologies, such as passive fiber network TAPs do not deal well with the full-duplex traffic.

Once a network tap is in place, the network can be monitored without interfering with the network itself. Other network monitoring solutions require in-band changes to network devices, which means that monitoring can impact the devices being monitored. This scenario is for active, inline security tools, such as next-generation fire walls, intrusion prevention systems and web application firewalls.

Once a tap is in place, a monitoring device can be connected to it as-needed without impacting the monitored network.

Some taps have multiple output ports, or multiple pairs of output ports for full-duplex, to allow more than one device to monitor the network at the tap point. These are often called regeneration taps.

A passive fiber optic tap.

Some taps, particularly fiber taps, can use no power and no electronics at all for the pass-through and monitor portion of the network traffic. This means that the tap should never suffer any kind of electronics failure or power failure that results in a loss of network connectivity. One way this can work, for fiber-based network technologies, is that the tap divides the incoming light using a simple physical apparatus into two outputs, one for the pass-through, one for the monitor. This can be called a passive tap. Other taps use no power or electronics for the pass-through, but do use power and electronics for the monitor port. These can also be referred to as passive.

Some taps operate at the physical layer of the OSI model rather than the data link layer. For example, they work with multi-mode fiber rather than 1000BASE-SX. This means that they can work with most data link network technologies that use that physical media, such as ATM and some forms of Ethernet. Network taps that act as simple optical splitters, sometimes called passive taps (although that term is not used consistently) can have this property.

Some network taps offer both duplication of network traffic for monitoring devices and SNMP services. Most major network tap manufacturers offer taps with remote management through Telnet, HTTP, or SNMP interfaces. Such network tap hybrids can be helpful to network managers who wish to view baseline performance statistics without diverting existing tools. Alternatively, SNMP alarms generated by managed taps can alert network managers to link conditions that merit examination by analyzers to intrusion detection systems.

Some taps get some of their power (i.e., for the pass-through) or all of their power (i.e., for both pass-through and monitor) from the network itself. These can be referred to as having inline power.

Some taps can also reproduce low-level network errors, such as short frames, bad CRC or corrupted data.

Basic functionality of an optical network tap

Advantages of a Network TAP

Here are some advantages of a Network TAP over port mirroring or SPAN:

  • Passive; fail-safe
  • Zero configuration
  • Secure
  • Exact duplicate of network traffic
  • No added latency or altered timing
  • Passes network errors in addition to good frames/packets
  • Oversubscription not an issue

Disadvantages and problems

Because network taps require additional hardware, they are not as cheap as technologies that use capabilities that are built into the network. However, network taps are easier to manage and normally provide more data than some network devices.

Network taps can require channel bonding on monitoring devices to get around the problem with full-duplex discussed above. Vendors usually refer to this as aggregation as well.

Putting a network tap into place will disrupt the network being monitored for a short time.[3] Even so, a short disruption is preferable to taking a network down multiple times to deploy a monitoring tool. Establishing good guidelines for the placement of network taps is recommended.

Monitoring large networks using network taps can require a lot of monitoring devices. High-end networking devices often allow ports to be enabled as mirror ports which is a software network tap. While any free port can be configured as a mirror port, software taps require configuration and place load on the network devices.

Even fully passive network taps introduce new points of failure into the network. There are several ways that taps can cause problems, and this should be considered when creating a tap architecture. Consider non-powered taps for optical-only environments or throwing star network tap for copper 100BT. This allows you to modify the intelligent aggregation taps that may be in use and avoids any complications when upgrading from 100 megabit to gigabit to 10 gigabit. Redundant power supplies are highly recommended.

Fully passive is only possible on optical connections any bandwidth and on copper connections from type G703 (2Mbit) and Ethernet Base-T 10/100 Mbit. On Gigabit and 10 Gbit Base-T connections passive tapping is currently not possible.

Gigabit Base-T issues

Explains the physical connection on Gbit Ethernet

To transport 1 Gbit of traffic full duplex (1 Gbit in each direction simultaneously) a very complex signal is used to reach the desired performance and quality. In case of Gbit Ethernet the signal is called PAM 5 modulation, meaning that each cable pair transports 5 bits simultaneously in both directions. The PHY chips at each end of the cable have a very complex task at hand, because they must separate the two signals from each other. This is only possible because they know their own signal, so they can deduct their own send signals from the mixed signals on the line and then interpret the information sent by their link partners.

Schematic function of a Gbit Copper TAP

To tap a copper link as shown in the picture above it is not possible to just tap the middle of the wire because all you will see is a complex modulation of two signals. The only way to terminate the signal (as shown in the picture) is to use a PHY chip to separate the signal and then send the signal on to the link partner. This solution is working but causes some other problems.

  1. It is not passive any longer, so in the case of a failure the link can go down and the services on the link are interrupted. To minimize this problem each copper tap has a bypass switch (relays), which closes in a power down situation (as shown in the picture), to bring the link back up. Also this solution will not detect that the link is down for a minimum of three seconds. These three seconds are a result of the autonegotiation behavior. This can not be changed because it is a vital function of the IEEE 802.3 standard as described in clause 28 and 40. Even this short interruption time could cause big problems in a network.
    • In some cases these links cannot be re-established without shutting down the services.
    • Rerouting functions in the network may take place
    • Streaming applications can collapse and cause more issues.
  2. Some layer 1 information is not transported over a copper tap (e.g. pause frames)
  3. The clock synchronization is affected. Sync-E over a standard Gbit copper tap is impossible and IEEE 1588 is affected, because of the additional delay a copper tap produces.

Comparison to other monitoring technologies

Various monitoring approaches can be used, depending on the network technology and the monitoring objective:

The simplest type of monitoring is logging into an interesting device and running programs or commands that show performance statistics and other data. This is the cheapest way to monitor a network, and is highly appropriate for small networks. However, it does not scale well to large networks. It can also impact the network being monitored; see observer effect.

Another way to monitor devices is to use a remote management protocol such as SNMP to ask devices about their performance. This scales well, but is not necessarily appropriate for all types of monitoring. The inherent problems with SNMP are the polling effect. Many vendors have alleviated this by using intelligent polling schedulers, but this may still affect the performance of the device being monitored. It also opens up a host of potential security problems.

Another method to monitor networks is to enable promiscuous mode on the monitoring host, and connecting it to a shared segment. This works well with older LAN technologies such as 10BASE-T Ethernet, FDDI, and token ring. On such networks, any host can automatically see what all other hosts were doing by enabling promiscuous mode. However, modern switched network technologies such as those used on modern Ethernets provide, in effect, point-to-point links between pairs of devices, so it is hard for other devices to see traffic.

Another method to monitor networks is to use port mirroring (called "SPAN", for Switched Port Analyzer, by vendors such as Cisco, and given other names, such MLXe telemetry by Brocade Communications and other vendors) or a monitoring protocol such as TZSP on routers and switches. This is a low-cost alternative to network taps, and solves many of the same problems. However, not all routers and switches support port mirroring and, on those that do, using port mirroring can affect the performance of the router or switch. These technologies may also be subject to the problem with full-duplex described elsewhere in this article, and there are often limits for the router or switch on how many pass-through sessions can be monitored, or how many monitor ports (generally two) can monitor a given session.

Countermeasures for network taps include encryption and alarm systems. Encryption can make the stolen data unintelligible to the thief. However, encryption can be an expensive solution, and there are also concerns about network bandwidth when it is used.

Another counter-measure is to deploy a fiber-optic sensor into the existing raceway, conduit or armored cable. In this scenario, anyone attempting to physically access the data (copper or fiber infrastructure) is detected by the alarm system. A small number of alarm systems manufacturers provide a simple way to monitor the optical fiber for physical intrusion disturbances. There is also a proven solution that utilizes existing dark (unused) fiber in a multi-strand cable for the purpose of creating an alarm system.

In the alarmed cable scenario, the sensing mechanism uses optical interferometry in which modally dispersive coherent light traveling through the multi-mode fiber mixes at the fiber's terminus, resulting in a characteristic pattern of light and dark splotches called speckle. The laser speckle is stable as long as the fiber remains immobile, but flickers when the fiber is vibrated. A fiber-optic sensor works by measuring the time dependence of this speckle pattern and applying digital signal processing to the Fast Fourier Transform (FFT) of the temporal data.

The U.S. government has been concerned about the tapping threat for many years, and it also has a concern about other forms of intentional or accidental physical intrusion. In the context of classified information Department of Defense (DOD) networks, Protected Distribution Systems (PDS) is a set of military instructions and guidelines for network physical protection. PDS is defined for a system of carriers (raceways, conduits, ducts, etc.) that are used to distribute Military and National Security Information (NSI) between two or more controlled areas or from a controlled area through an area of lesser classification (i.e., outside the SCIF or other similar area). National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 7003, Protective Distribution Systems (PDS), provides guidance for the protection of SIPRNET wire line and optical fiber PDS to transmit unencrypted classified National Security Information (NSI).

See also

References

  1. 1 2 3 Abdullah A. Mohammed, Dia M. Ali, "Network Tapping System Based on Customized Embedded Linux: Design and Implementation", International Journal of Networks and Communications, Scientific & Academic Publishing SAP, accepted Vol 5 (5), 2015
  2. ↑ http://www.lovemytool.com/blog/2018/08/infrastructure-taps-and-the-need-for-a-comprehensive-visibility-system-in-order-to-achieve-a-100-guaranteed-view-of-all-net.html
  3. ↑ "Sniffing Tutorial part 1 - Intercepting Network Traffic". NETRESEC Network Security Blog. 2011.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.