Filtered SINGLEstream Q & A | FAQs |
Brief Overview
The Filtered SINGLEstream™ Aggregation Tap gives you the ability to tap two 10/100/1000 network segments simultaneously. The physical media can be either fiber or copper connections. Customers are also able to choose between Single or Multimode connections for the network taps.
Passive tapping technology integrated into the fiber connections ensures that in the event of a power loss to the Filtered SINGLEstream™ , network traffic will not be interrupted. If copper connections are used, a slight
600 ms delay occurs to reconnect the network. A variety of fiber tap ratios is available, typically 50/50 is preferred by most customers.
Traffic destined between network ports is not filtered or interrupted. No filtering is done between network devices. All manipulation is done to copies of the network traffic.
Network and Monitor ports can be selected in full duplex speeds from 10, 100, or 1000Mb.
Aggregation is flexible and can be accomplished by allowing any network port to aggregate to any monitoring port or multiple monitoring ports.
Filtering can be accomplished on a number of criteria including:
- IP Address
- MAC Address
- Port Number
- Port Ranges
- Customized Filter on any number of bits in the TCP/UDP header.
If multiple filter criteria are required, then an AND function is used to permit packets through to the monitoring device selected.
For example, if a filter is chosen for packets from IP address subnet 10.1.2.X and a filter for ports in the range from 1024-2048. Then the filter created and applied will look for packets that match BOTH of these criteria. Any other packets are dropped.
Ingress and egress filters can be applied to every port. This provides a totally customizable method of analyzing network data.
FAQs
Q: Does the Filtered SINGLEstream™ have redundant power supplies?
A: Yes, two load sharing power supplies help prevent loss of monitoring capability. Network connections made over fiber optics, are totally passive. Loss of power to the Filtered SINGLEstream™ would not effect data flowing between network devices. Monitoring capability is disabled in the unlikely event that both power supplies do not function.
Q: I’ve already got a firewall, how does the Filtered SINGLEstream™ help me?
A: The Filtered SINGLEstream™ is not a firewall. Traffic between network devices is tapped, which allows traffic to continue to flow to the downstream network device. The Filtered SINGLEstream™ uses the tap functionality to copy network traffic and then aggregate and filters the copies. This prevents analysis tools or Intrusion Detection Sensors from being oversubscribed.
Q: What speeds does the Filtered SINGLEstream™ support?
A: 10,100 and 1000Mb Full Duplex.
Q: How many ports does the Filtered SINGLEstream™ have?
A: There are 8 ports on the Filtered SINGLEstream™ . Four ports are available for tapping network connections, and four ports are available for use by monitoring devices.
Q: What media types are supported on the Filtered SINGLEstream™ ?
A: The Filtered SINGLEstream™ supports fiber or copper media types. Single mode or multimode fiber versions are available. For monitoring, Small Form Pluggable devices support either single or multimode fiber monitoring tools. These small form pluggables may be ordered when you order your Filtered SINGLEstream™ . You need to specify the type of fiber connections you need for your network devices, and the split ratio if you are using fiber taps.
Q: Where would I use a filtered aggregation tap in my network?
A: The most likely locations on the network will be those in which probes or IDS devices need 24x7 visibility. These include the links between switches and critical servers, full duplex connections between routers and firewalls, and links between firewalls and a demilitarized zone (DMZ).
Q: I have limited rack space, how big is the Filtered SINGLEstream™ ?
A: The Filtered SINGLEstream™ is only 1U high, or 1.75 inches, and fits in a standard 19 inch wide rack.
Q: Can I connect the output of the Filtered SINGLEstream™ to my existing matrix switches?
A: Yes – the output of a Filtered SINGLEstream™ may be connected to a Datacom MX16100 copper switch in exactly the manner as a SPAN port or shared media hub is connected. It may also be used In-Line with the 2X16FD-SY copper switch.
Q: Does the Filtered SINGLEstream™ pass all seven layers of OSI traffic ?
A: The Filtered SINGLEstream™ is completely non-intrusive and lets all data pass through the network untouched. It can be easily configured to pass all data (layers 1-7) to the monitoring ports. By default, it only sends data from Layers 3-7 to the devices connected on the monitoring ports. Security devices are usually unconcerned with Layer 1 and Layer 2 traffic or unable to process it. As such, most all security devices discard Layer 1 and Layer 2 data anyway. Even protocol analyzers and network probes primarily concentrate on Layers 3-7 and might also be unable to process Layer 1 and Layer 2 data unless equipped with special software and hardware. In the areas of the network where the Filtered SINGLEstream™ will most likely be used, Layer 1 and Layer 2 traffic are not typically a primary concern. While any customer who is used to traditional monitoring or analysis using SPAN is already used to working exclusively with Layers 3-7, the Filtered SINGLEstream™ can pass all seven layers of traffic, including layer 1 and 2 errors.
Q: What type of operating system does the Filtered SINGLEstream™ use?
A: The Filtered SINGLEstream™ uses a proprietary operating system, similar to UNIX.
Q: How do I connect to and configure the Filtered SINGLEstream™ ?
A: A small proprietary client is loaded on to any Windows based machine, which allows a simple and easy to use GUI to run which will configure the Filtered SINGLEstream™ .
Q: What Authentication features are built into the Filtered SINGLEstream™ ?
A: The Filtered SINGLEstream™ supports RADIUS for authentication.
Q: I need to review log information for security purposes is this supported?
A: Yes, the Filtered SINGLEstream™ supports local and remote syslogging. Logs from the Filtered SINGLEstream™ can be sent to a number of syslog servers.








