Network Taps, in addition to being available for copper or fiber media, can be purchased in a fixed configuration, typically called “duplex Taps” - or as “Aggregation Taps.” The latter category offers options for how the data copies are distributed among the monitor ports. This article will clarify the differences between the two Tap types, as well as exploring the rationale for different Tap configurations, and examples of their applications.

Network Taps, in addition to being available for copper or fiber media, can be purchased in a  fixed configuration, typically called “duplex Taps” – or as “Aggregation Taps.”  The latter category offers options for how the data copies are distributed among the monitor ports. This article will clarify the differences between the two Tap  types,  as well as exploring the rationale for different Tap  configurations, and examples of their applications.

Taps Overview

Simple Duplex Taps are passive or non-intrusive,  inserted into a production link, and send copies of the two sides of the link (Rx and Tx) out two separate monitor ports. A significant benefit is that they are moderately priced and  non-managed devices (do not require management port connectivity or configuration.) But…  there are some limitations to this tap style. Many data capture and analysis devices have only a single Capture NIC (capture interface) on which they can receive data. A good example of this is a laptop running the open source Wireshark packet sniffer program.  Additionally, even if a second capture NIC is added, it is necessary to have specialized capture/analysis software that can recombine the Rx and Tx data streams, thus allowing the user to view the original duplex conversation in its entirety – on a single screen. An out of band device (i.e. not used in a link) known as a network packet broker can accept the two data streams from a simple  duplex tap, multiple taps, and also SPAN ports, allowing them to be aggregated together and sent out one or more monitor ports to tools that have only one Capture NIC. 

But what if a network packet broker is not a good fit for the application?

Enter…  the Aggregation Tap. Available for both copper and fiber media, this device can be configured to internally aggregate or merge the Rx and Tx data stream copies. This allows devices with a single Capture NIC to receive and view the duplex conversation in its entirety – without requiring highly specialized software.  This can be a simple copper 1G capable tap, which has a slider switch allowing it to be used as a simple duplex Tap or an aggregation Tap with two monitor ports

Many aggregation tap models are more complex, have the capability to tap multiple links, send data to more than two monitoring tools, send both aggregated and non-aggregated data copies, and more.

Additional benefits of aggregation Taps include:

1) Multiple monitor ports, allowing multiple tools to view and capture the same aggregated data stream
2) Models with multiple taps, allowing more than one link to be merged into a single data stream                      3) “Any-to-Any” monitor ports, which allow additional inputs from other Taps or SPAN ports to be aggregated            4)  Media conversion for monitor ports – allowing fiber Taps to send data to copper monitoring tools or vice versa                                                                                                                                         5) Speed conversion  – allowing  merged data from lower speed links to be sent out at a higher speed to tools   (e.g. 1G links sent to a 10G tool)

Tap Configuration

Aggregation tap users must make conscious choices about what to do with data copies, thus determining how the tap will be configured.

These include:

  1. Sending data as an aggregated data stream to more than two monitoring tools
  2. Sending non-aggregated data (separate Rx and Tx copies) to one specialized tool, while also sending aggregated data streams to others
  3. Aggregating data from 2 or 4 links to a single tool
  4. Using hardware based filtering to parse data and send only certain types of data out certain monitor ports

Configuration Examples

  1. Simple duplex Tap with slider switch to also yield aggregated output
  2. This  is standard deployment for any fixed simple duplex Tap (non-aggregating.) Note that a specialized capture tool with dual capture NICs and special software must be used in order to view the entire original full duplex conversation.

Image preview
  • Same Tap but used in Aggregation mode. The Rx and Tx data stream copies are aggregated. Identical copies of the merged data stream are sent out both monitor ports, allowing two separate tools, each with just a single capture NIC to view both sides of conversation.


Description automatically generated

(Datacom Systems CTP-1000)

  • Dual link aggregation Tap being used to aggregate data from an Active-Passive Firewall link pair. Data copies from both links are aggregated into a single data stream that is viewed by a single monitoring tool. In the event that the Active firewall link fails, the traffic automatically shifts to the Passive link.  This Tap configuration ensures that the monitoring tools continue to receive data uninterrupted – even though the Active link failed. An identical deployment is used for firewall link pairs that are dynamically load balanced and both Active at all times – except in the event of a link failure.

(Datacom Systems SINGLEstream model SS-2206BT-BT-S)


Description automatically generated
  • Multi-link high density aggregation Tap with additional Any-to-Any monitor ports that can function like a packet broker, accepting data from other taps and/or SPAN ports. This product family has four SFP+ ports in every model, allowing aggregated data to be sent to 10G monitoring tools, with the higher throughput capacity needed for larger amounts of merged data.

 (Datacom Systems SINGLEstream model SS-G4C8C4S)


Description automatically generated

For individual guidance on the most optimal tap configurations for your network, and a detailed explanation of the commands used to create them, contact Datacom Systems at [email protected] or +1 315-463-9541

Recent Posts


How to Troubleshoot Fiber Network TAPs

Network Taps are a crucial part of the tool kit used by engineers responsible for network security, performance, and capacity management. Taps are robust devices that rarely ever exhibit issues, but as with any network equipment – it may occasionally be necessary to troubleshoot them. In some cases this is an inherent part of a multi-layered process of elimination, but in certain circumstances the process might begin with the Tap itself. The following procedures are presented with Datacom Systems fiber Taps* in mind, but the general principles are applicable to all brands of Taps.

Read More »
Network Management & Architecture

Software Management for Taps and NPBs

In previous articles we reviewed the overall topic of management interfaces to Taps and NPBs and in subsequent chapters took a deep dive into the topics of Fault Management and Configuration Management. In this chapter we will focus on Software Management and its related topics. Subsequent chapters will cover other management topics including accounting, performance monitoring, security and remote access.

Read More »

We'll be Glad to Help You

For the latest information, product updates, and to check the status of your service agreement, please contact our support team