Page 1
codes codes codes codes codes codes Provides access to the data streams passing through a high-speed network device and a switch. Models available to monitor both copper and optical links. Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500) Customer FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax Support...
Page 3
FEDERAL COMMUNICATIONS COMMISSION and INDUSTRY CANADA RADIO FREQUENCY INTERFERENCE STATEMENTS This equipment generates, uses, and can radiate radio-frequency energy, and if not installed and used properly, that is, in strict accordance with the manufacturer’s instructions, may cause interference to radio communication. It has been tested and found to comply with the limits for a Class A computing device in accordance with the specifications in Subpart B of Part 15 of FCC rules, which are designed to provide reasonable protection against such interference when the equipment is operated in a...
Page 4
El aparato eléctrico debe ser montado a la pared o al techo sólo como sea recomendado por el fabricante Servicio-El usuario no debe intentar dar servicio al equipo eléctrico más allá a lo descrito en las instrucciones de operación. Todo otro servicio deberá ser referido a personal de servicio calificado.
Thank you for purchasing the TAP: the most robust, secure, and convenient mechanism for network analyzers and similar devices to copy data streams from high-capacity network links. A network Test Access Port (TAP) provides access to the data streams passing through a high-speed, full-duplex network link (typically between a network device and a switch.
Page 9
Most enterprise switches copy the activity of one or more ports through a Switch Port Analyzer (SPAN) port, also known as a mirror port. An analysis device can then be attached to the SPAN port to access network traffic. Figure 1 Table 1 to determine whether to use a TAP or a SPAN/mirror port.
Table 1 Pros and Cons of TAPs and SPANs SPAN/mirror port Pros Eliminates the risk of dropped packets Low cost Monitoring device receives all packets, Remotely configurable from any system including physical errors connected to the switch Provides full visibility into full-duplex networks Able to copy intra-switch traffic Cons Analysis device may need dual-receive capture...
Page 11
combined), but its design requires that the analyzer be a specialized device with a dual-receive capture interface that is capable of capturing the TAP’s output, providing accurate timing, and recombining the data for analysis. Table 2 list the advantages and disadvantages of three common methods of accessing traffic from full-duplex networks for analysis, monitoring, or forensics: Table 2 Span vs Aggregator vs Full-duplex TAPs...
channel. For more details, see “When to use a SPAN/mirror port” on page 12. Attaching a monitoring or analysis device to an Aggregator TAP inserted into a full-duplex link. As with a SPAN, the Aggregator TAP copies both sides of a full-duplex link to the analyzer’s single receive channel.
Page 13
Routes the integrated signal to the send channel of the SPAN/ mirror port Each of these activities burdens the switch’s internal processor. These demands on the switch’s CPU have implications for both your monitoring equipment and general network performance. Using a SPAN/mirror port to capture network traffic for analysis presents the following risks: As total bandwidth usage for both channels exceeds the...
Page 14
Cloning your SPAN/mirror port You can still access your SPAN/mirror port even if all of your SPAN/ mirror ports on your switch are used. This is fairly common, and you can use a TAP to produce two or three copies of the SPAN/mirror port.
Joining SPAN/mirror ports If you have a primary switch and a failover switch, you can connect both of them to an Aggregator TAP. Connect one of them to Link A and the other to Link B. It does not matter whether the primary switch is connected to Link A or Link B, and you do not need to know which one is “live.”...
Page 16
: TAP B UFFER The role of the buffer is to absorb traffic spikes of over 50% full-duplex bandwidth saturation (100% with both sides combined), because the analyzer’s single-receive interface cannot receive the traffic fast enough to keep up at line rate. For more details about the Aggregator TAP’s buffer, see “Choosing an Aggregator TAP buffer size”...
Although this can be the most expensive solution, it is also the only solution that guarantees complete accuracy even when the network is highly saturated. All TAPs from Black Box, except the Aggregator TAPs, are full- duplex. See “Copper TAPs”...
Major features The major features of the Black Box full-duplex Copper TAPs are: Passive access at 10/100 or 1000 Mbps without packet tampering or introducing a single point of failure No packet loss if the TAP loses power ...
Redundant power supply Rack or bay mount If any part is missing or damaged, contact Black Box Support immediately. Installing the Copper TAP After reviewing the information in “Deciding whether to use a TAP or a SPAN/mirror port”...
Page 21
NSIDE THE When traffic comes in to Link A, two copies are made in the TAP. One copy is sent out Link B to the switch and the other copy is sent out Analyzer A to the analysis device. A similar thing happens with traffic that comes in Link B.
and Link A then must use the same speed as Link B. If your link is under test as part of a failover or redundancy arrangement, then connect the failover device to Link B. See “How do I connect my failover devices?”...
or both power supply sockets. Connecting both sockets to different external power sources (using Network Instrument’s optional adapter kit TC2P-K) provides fail-safe power redundancy for the Analyzer side. The network pass-through link remains unaffected even if power to the TAP is interrupted. For a detailed description of what happens, read the information in “10/100/1000 TAP”...
Connected. The Speed LED is on and the Link LED shows activity. The Link LEDs flicker faster when there is more traffic on the Link and slower when there is less traffic. The Analyzer LEDs follow the Link LEDs. Because the TAP is passive, all activity on the Link port is automatically and passively copied to the Analyzer port and therefore the Analyzer port LED blinks at the same speed as the Link port —...
Page 25
common speed and other capabilities. The LED pattern is that the Speed LEDs flash and the Link LEDs flicker. Connecting. The link parameters are attempting to connect using the parameters determined during the Capabilities search. The LED pattern is that the TAP shows the connection speed while the Link LEDs continue to flicker.
Technical specifications This section lists the dimensions, power requirements, supported media, and environmental requirements. For the regulatory compliance statements, see “FCC compliance statement” on page 24. Table 4 Technical specifications Power requirements AC Input 90V - 264V, 47-63Hz Operational Voltage 5V (+10%/-5%, <...
Major features The major features of the Black Box full-duplex Optical TAPs are: Passive access at 1 Gbps or 10 Gbps without packet tampering Allows you to connect and disconnect the analysis device as needed without taking the network down All traffic (including errors) is passed from all OSI layers for ...
Installing the Optical TAP After reviewing the information in “Deciding whether to use a TAP or a SPAN/mirror port” on page 8 and “Choosing between a SPAN, Aggregator, or full-duplex TAP” on page 10, you decided an Optical TAP was the right one for you. Use the information in this section to install your TAP.
Page 30
Figure 7 Cabling the Optical TAP To cable the Optical TAP, follow the steps outlined below. The example and diagram show how to monitor the link between a server and switch. AUTION Before you temporarily break the link between the device of interest and the network, you may want to shut down access to that device and notify users of the down time.
analyzer for details. If auto-negotiation is not disabled, the analyzer will not be able to receive the stream from the TAP until it is. As an alternative, you can split your own duplex cable (or use two simplex cables) to connect each side of the Analyzer ports on the TAP to the receive ports on each of the NICs in the analyzer.
copies. One part of the split signal is sent to the other device on the network, while the other is simultaneously passed to the analysis or monitoring appliance. As with all devices inserted into an optical link, one side effect of TAP usage is signal attenuation. A TAP attenuates the signal for two reasons: A portion of the signal strength is “siphoned off”...
Page 33
Transmit power from the network devices Cable distance from the network device to the TAP Maximum insertion loss from the TAP (see Table Cable distance from the TAP to the analyzer Analyzer port receive sensitivity Other less crucial items that may also affect you include: ...
Page 34
Determining your power loss budget is a several step process that requires you to know the send power and receive sensitivities of the devices connected to the TAP, and requires that you do some basic math. Use these equations to determine the light available in decibels at the analyzer.
Page 35
(Number of Connectors * Connector Loss) + (Fiber Length of Link A * Fiber Loss) + (Fiber Length of Analyzer * Fiber Loss) = Attenuation Subtract the output from step from step 4. Power Loss Budget - Attenuation = Actual Loss Repeat step through step for Link B to the analyzer.
Page 36
This shows the power loss budget for Link A to Link B. Link A ↔ Link B Send Device Power -9.000 Receive Device Sensitivity -19.5 Power Loss Budget 10.500 Number of Connectors x 0.5 Connector Loss Connector Loss Fiber Length Link A (8 meters) 0.008 x 3.0 Fiber Loss Link A...
Page 37
This shows the power loss budget for Link A to the analyzer. → Link A Analyzer Send Device Power -9.000 Receive Device Sensitivity -17.5 Power Loss Budget 9.000 Number of Connectors x 0.5 Connector Loss Connector Loss Fiber Length Link A (8 meters) 0.008 x 3.0 Fiber Loss Link A...
Use this page to create your own power loss budget from Link A to Link B if you are considering an Optical TAP with a split ratio other than 50/50. Then use it for your Link A or Link B to the analyzer, whichever link has the longer fiber length.
mode cable. Check with the cable manufacturer to determine specific attenuation rates. Managing attenuation Managing signal attenuation is critical for running a network at optimal performance. A problem arises when a signal is attenuated so much that the destination cannot interpret the signal or the signal fails in route.
Technical specifications This section lists the dimensions, power requirements, supported media, and environmental requirements. For the regulatory compliance statements, see “FCC compliance statement” on page 24. Table 6 Technical specifications Power requirements AC Input None Environmental requirements Temperature range -40° to +185° (F) / -40° to +85° (C) (operating) -52°...
TAP from the network than can be sent to the analyzer. These are the Aggregator TAPs: Copper Aggregator TAP The major features of the Black Box TAPs are: Passive access at 10/100/1000 Mbps without packet tampering or introducing a single point of failure No packet loss if the TAP loses power ...
Redundant power supply Rack or bay mount If any part is missing or damaged, contact Black Box Support immediately. Choosing an Aggregator TAP buffer size With the understanding that an Aggregator TAP is designed for use on network links with low-to-moderate utilization, they do have their place.
Page 44
To monitor links that are well over 50% utilization for minutes at a time, a full-duplex TAP may be a better choice. After the buffer is full, an Aggregator TAP will drop packets. Use Figure 9 to choose the best buffer size for your Aggregator TAP. The graph shows the buffer size and duration of traffic spikes that the buffer can absorb.
Figure 9 Bandwidth utilization that a buffer can absorb on a gigabit network Installing the Copper Aggregator TAP After reviewing the information in “Deciding whether to use a TAP or a SPAN/mirror port” on page 8 and “Choosing between a SPAN, Aggregator, or full-duplex TAP”...
Page 46
Connect the TAP to your analyzer or other monitoring device using standard Ethernet cables. Figure 10 Connecting the TAP to the network device, switch, and analyzer AUTION Before you temporarily break the link between the device of interest and the network, you may want to shut down access to that device and notify users of the down time.
Other things to consider: “Can I daisy chain an Aggregator TAP?” on page 52 “Can I “team” NICs in my analyzer?” on page 53 Ports, LEDs, and power connectors This section provides a brief overview of installing the TAP and understanding the status LEDs.
Figure 12 Back panel showing power connectors and serial number Interpreting the Link and Speed LEDs When the TAP is powered up and correctly connected to functioning devices, the Speed LED indicators simply show the connection speed. The Link LED indicators are either lit steadily (idle) or flicker (data transfer) depending on whether there is any traffic present.
Page 49
whether there is any traffic present. If a Link LED is unlit, there is no functioning device connected to that port. “How do I connect my failover devices?” on page 55 for details about what happens when a primary device fails. Error conditions are shown by the Speed LEDs for approximately 10 seconds, after which the TAP resets itself (goes back to the Search connection step).
Page 50
Table 8 Technical specifications (Continued) Link ports Copper: Straight-through RJ-45 cable or crossover cable Copper-to-Optical: Straight-through RJ-45 cable or crossover cable Optical-to-Copper: Fiber diameter: Multimode: 50 or 62.5/125 micrometers (μm) Single-mode: 9/125 micrometers Wavelength ranges Multimode: 850 or 1300 nanometers Single-mode: 1310 or 1550 nanometers Copper Analyzer ports Straight-through RJ-45 cable or crossover cable...
What latency does a TAP create? A Black Box TAP’s latency is 200-250 nanoseconds. This is the time it takes to receive the packet, process and copy it, and send it out the other side (Link A to Link B).
If you are attempting to daisy chain Aggregator TAPs to more than two analyzers and you are certain your MTU on the receiving devices is high enough, contact Black Box Support for assistance. Can I “team” NICs in my analyzer? Yes, it is possible, with some caveats.
Page 54
EQUIREMENTS You need at least one IntelPro/1000 card that supports Advanced Network Services. If the card has two ports, they can be teamed, otherwise another NIC with an unused port must be present. Connect the TAP to the analyzer using the appropriate cables. The TAP is cabled between the devices being monitored normally (i.e., it provides a pass-through circuit for the link under test).
Choose the “Team with other adapters” option and then click New Team... to start the New Team Wizard. The first dialog lets you name the Team (you may want to call it something like “Virtual Dual-receive”). Click Next and add another adapter/port that supports teaming (for example the second port on a dual-port IntelPro card).
Not seeing traffic at the analyzer from the TAP If your TAP is not transmitting to the analyzer as you expect, check the following: The TAP is receiving power using a Black Box power adapter. The Link A and Link B lights flash when there is traffic traversing through the TAP, which indicates the TAP has power.
TAP, but it may also indicate that the TAP is fine and there are other problems on your network. Contact Black Box Support for assistance. Choosing crossover or straight-through cables rev. 1...
VLAN tags not visible at the analyzer All TAPs pass VLAN tags with the packets. If you are not seeing the VLAN tags at the analyzer, check the following: On the switch: Confirm that the SPAN was created to pass VLAN tags. ...
Index Numerics cables dual-receive capture card 10/100 network no traffic from TAP 10/100 TAP ports, unidirectional see also Copper TAP single-receive capture card auto-negotiation attenuation passive managing straight-through cables optical cables 10/100/1000 TAP power loss budget 32, 34–37 see also Copper TAP TAPs active negotiation auto-negotiation 22, 30,...
Page 60
heat dissipation internal processing IntelPro LEDs internal processing parts Copper TAP ports power connectors power loss joining, SPAN 15ff rear panel 23ff specifications Copper-to-Optical Aggregator TAP CRC errors 8, latency crossover cables LEDs Aggregator TAP Copper TAP light meter daisy chain light power 31–32 light power, equation...
Page 61
cable distance Power over Ethernet cable lengths 35ff cables decibels rear panel features Aggregator TAP 48ff maximum insertion losses Copper TAP 23ff multimode 33, redundancy, see failover parts repeaters 31, passive repeaters, Optical TAP patch panels risks, SPAN power loss budget runts repeaters single-mode 33, 38,...
Page 62
TCP stack UNIX up-converting VLAN tags when to use, SPAN T–W Legend: ff=Figure, t=Table rev. 1 Index...
Page 64
724-746-5500 or blackbox.com. About Black Box Black Box provides an extensive range of networking and infrastructure products. You’ll find everything from cabinets and racks and power and surge protection products to media converters and Ethernet switches all supported by free, live 24/7 Tech support available in 30 seconds or less.
Need help?
Do you have a question about the TS230A-R2 and is the answer not in the manual?
Questions and answers