A tap’s ability to aggregate full-duplex and multiple link traffic is a great benefit to IT management because it maximizes visibility and extends the ROI of analysis and monitor­ing equipment. However, when traffic from multiple links and full-duplex connections exceeds the capacity of a gigabit output connection, events can be dropped or monitoring solutions can become over saturated with data. Hardware-based filtering span aggregation taps eliminate traffic not of concern for analysis or monitoring.

Filtering is based on IP addresses, VLAN ID, application port numbers, MAC addresses or byte/bit pattern. By focusing on only certain packet types, network managers can eliminate oversubscription to aggregation ports and increase the processing capability of monitoring and analysis devices. Replication of traffic to multiple monitoring ports reduces the number of network access points needed and extends management access for greater ROI.