We have entered into the era of Data Security Legal Compliance and Lawful Intercept which requires that we must monitor all of the data and not just “sample” the data, with the exception of certain very focused monitoring technologies (e.g., application performance monitoring). These demands will continue to grow since we have become a very digitally-focused society. With the advent of VoIP and digital video we now have revenue-generating data that is connection-oriented and sensitive to bandwidth, loss, and delay. The older methods need reviewing and the aforementioned added complexity requires that we change some of the old habits to allow for “real” 100% Full Duplex real-time access to the critical data.
It's time to evaluate our network access points. If you are still using SPAN ports, you will be neglecting compliance regulations. As we know the top priority for a switch, of course, is to direct network traffic. Therefore, as the switch reaches capacity, packets to the SPAN port will be dropped. This problem is critical because, just as a need for switch traffic analysis presents itself (packets overrunning switch capacity), so does the condition when the SPAN port will not provide accurate switch traffic information.
Even in low utilization environments, there are certain packets such as undersized or error packets that can be filtered on the switch and never make it to the SPAN port. If the analysis requires 100% of packets to be submitted to the appliance, SPAN cannot guarantee such accuracy.
On the other hand, network TAPs (Test Access Points) make an exact copy of all of the traffic that flows between two end-points in a network. This simple device is able to document 100% capture with no packet manipulation. Once the data is copied, it can be used for monitoring, security, and analytic use.
In summary, being able to provide “real” access is not only important for Data Compliance Audits and Lawful Intercept events, it is the law (keeping our bosses out of jail has become a very high priority these days).
