Network Tap Product

Overview

A network tap is a purpose-built device for seeing traffic on a live Ethernet link without being part of the network. It is inserted inline — the cable that ran from a switch to a router now runs through the tap's two Network Ports — and every frame passing in either direction is copied out the Monitor Ports to an analyzer, intrusion-detection sensor, or packet recorder. Unlike a switch SPAN port, a tap has no MAC address, no IP address, and no way to transmit into the monitored link, which is why security and troubleshooting practice prefers taps at critical boundaries: the evidence they produce is complete and the monitoring system cannot be addressed or attacked from the wire.

This is an active tap for 1000BASE-T. Gigabit copper cannot be tapped passively the way 10/100 or optical fiber can, because all four pairs carry signal in both directions simultaneously using echo cancellation; the only way to extract the two directions is to terminate the link in a real Network PHY and regenerate it. That makes the tap a powered device sitting in the middle of a production link, which is why the Fail-Safe Relay Section section and the dual supplies in Power Section dominate the design: the tap must never be the reason the link goes down.

How it works

In normal operation, port A's PHY terminates the signal from one endpoint and the Tap FPGA forwards every frame to port B's PHY, and vice versa, adding well under a microsecond of latency. The same logic copies the A-to-B stream to monitor port 1 and the B-to-A stream to monitor port 2. Splitting directions onto separate outputs is deliberate: a full-duplex gigabit link can carry 1 Gbit/s each way at once, 2 Gbit/s total, which would overrun any single gigabit monitor port during bursts. A SPAN port suffers exactly this oversubscription and silently drops frames; the dual-output tap structurally cannot.

The tap also copies what a switch would discard. Runts, frames with bad checksums, and corrupted symbols are forwarded to the monitor ports as received, because for troubleshooting, the damaged frames are often the entire point — a failing NIC or duplex mismatch announces itself in errored frames that a SPAN port hides.

Fail-to-wire is the defining safety feature. The Relay set sits directly in the signal path between the A and B jacks. While the tap is powered and the Watchdog Controller sees the logic running, the relays route the pairs through the PHYs. If power fails, firmware hangs, or the watchdog itself stops being petted, the Charge Reservoir discharges into the relay coils and the contacts fall to a direct metallic connection between A and B. The link endpoints see a brief interruption — a few milliseconds, after which their PHYs renegotiate as if a cable had been reseated — and the production link runs unmonitored but alive. The OR-ing Stage combine two independent Power Supply adapters so that a single supply failure never even triggers the bypass.

Variants

The same role is filled by several constructions. A passive fiber tap is the simplest: a fused optical splitter diverts a fixed fraction of the light, typically a 70/30 split, to the monitor outputs, with no electronics and nothing to fail — the trade-off is the split's insertion loss, which must fit within the link's optical budget. Passive copper taps exist only for 10/100BASE-TX, where resistive bridging onto the two active pairs works. Regeneration taps duplicate the copied traffic to several monitor outputs so multiple tools see the same link; aggregation taps merge both directions into one output stream for tools that accept occasional oversubscription; and bypass taps extend the fail-to-wire idea to inline security appliances, watching a heartbeat from an IPS and routing around it within milliseconds if it stalls.

Deployment

Taps are installed during scheduled windows, since inserting one breaks the link momentarily, and are then left permanently in place — the monitor ports sit dark until someone attaches a tool. Typical positions are the inside and outside of a firewall, the uplink of a server distribution switch, and demarcation points where a provider's responsibility ends, where having unimpeachable capture predates any dispute. Because the monitor PHYs transmit only, with the receive pairs unconnected at the Monitor RJ45, nothing plugged into a monitor port can inject traffic into the production link; capture appliances connected there often also run with unbound, address-less interfaces, making the whole monitoring chain unreachable from the monitored network. The Enclosure is fanless sheet steel drawing about 5 W, sized so several taps fit a 1U rack shelf at the network edge they observe.