Data monitoring switch: Difference between revisions

Revision as of 21:05, 25 August 2009

Revision as of 08:15, 26 August 2009

Line 2:

Several other terms have been used to describe this class of device, including '''data access switch''', '''tool aggregator''', '''net tool optimizer''', and '''[[distributed filter tap]]'''.

== Function ==

[[Image:Net Optics Director.PNG|380px|thumb| Standard [[Data monitoring switch]] with 1U chassis, high port density]]

A data monitoring switch typically provides 24 to 38 ports in a 1U 19-inch chassis, with higher port density devices expected in the future. Ports may be dedicated as network inputs or tool outputs, or may be configurable as either. Network input ports may be paired to provide in-line connectivity (integrated [[Network tap| Tap ]] function), or independent to take input from external network Taps or network switch [[SPAN port]]s. Some devices have the ability to interconnect chassis to configure logical systems with hundreds of ports.

When a number of monitoring tools are connected to the data monitoring switch’s tool ports, copies of traffic from any of the network ports can be switched to any of the tools using the data monitoring switch’s management interface. A unique characteristic of the data monitoring switch, as opposed to matrix switches and aggregating Taps, is that it can support a flexible set of port mappings including:

Line 18 ⟶ 16:

In addition to directing monitoring traffic, data monitoring switches are capable of filtering traffic by Layer 2 to Layer 4 protocol criteria such as protocol and IP address, enabling only traffic of interest to be sent to specific tools. This capability can prevent tool oversubscription and facilitate drilling down on issues.

Additional capabilities found in some data monitoring switches include load balancing across multiple tool ports, filtering on patterns in packet payloads, and converting media and data rates so tools can be used to monitor traffic from dissimilar links.<ref>[[http://www.gigamon.com/GigamonU/GU06112017WAN.DAN.DAN.pdf Gigamon DAN]]</ref> Beyond this, some data monitoring switches support stacking, which allows them to be architected as a traffic capture system configured as a fully distributed mesh.<ref>[http://www.vssmonitoring.com/customers/stacking.asp VSS vStack+]</ref>

== Device Management ==

Line 27 ⟶ 25:

*A platform (Windows) based server; this interface is preferred for managing a large number of devices through a single interface

*Third-party [[SNMP]] management tools; this interface in preferred in environments with centralized SNMP management systems such as [[IBM Tivoli]] or [[HP OpenView]] <ref>[http://www.HP.com/Go/openview HP Open View]</ref>

== Advantages ==

Line 63 ⟶ 60:

*[[Network monitoring]]

*[[Net Optics]]

[[Category:Networking hardware|Computer network security]]