SPAN Port Aggregation with the VERSAstream™ Data Access Switch

Monitoring Multiple SPAN Sessions with a Single Receive Device

Aggregation is a technology that combines a bi-directional full duplex data transmission into one single stream of data. Additionally, aggregation can allow for the combination of data transmitted from multiple networks or SPAN ports. An identical copy of this single stream of data can then be sent to any connected monitoring device. The connected monitoring device can receive the entire full duplex conversation or aggregate data from multiple networks with a single network interface card (NIC) also without having to reassemble the traffic.

span port aggregator monitors multiple span ports aggregates the traffic and provides output to a single intrusion detection system

Benefits of Aggregation

In the past, network and security managers were required to install a monitoring device on each SPAN port they needed to monitor. This was not only time-consuming to deploy and manage, requiring more personnel and equipment, it was also expensive. If lack of monetary and human resources prevented deployment of monitoring devices on every network segment, critical links were often compromised as network segments would go uncovered.

By increasing the network segments a single monitoring tool can cover, a multi-link aggregator can dramatically improve network security, while saving organizations a considerable amount of money in deployment and management costs as well as licensing fees for software - as appliance vendors typically require individual software licenses for each deployment (i.e. per sensor).

In addition, data access switches provide many more benefits:

Increases port capacity on monitoring devices because only one NIC is required to receive aggregated data
Empowers existing, legacy, and open source tools that may not be able to receive more than one stream of data or reassemble traffic
Provides a "plug and play" solution to eliminate management and expense of other aggregation solutions
Provides reliable data transmission without degrading network performance
Provides visibility into data at different points in the network and as it travels through the network. See Multi-Point Network Analysis.
Reduces problem resolution time by eliminating the need to collect and manually assemble trace or log files from separate tools on separate networks

Stop Fighting Over SPAN Ports

To allow multiple network devices to access and share the same SPAN port while maintaining the benefits of aggregation, find out more about VERSAstream™ Data Access Switches.