Using a TAP during an engagement

In the previous section, we discussed what SPAN is and how to configure and use it. In this section, we are going to review what a TAP is, the different types of TAPs, and how they can be used in an engagement. Typically, TAPs are hardware devices that are inserted between two communication links so that we can perform full packet replication. TAPs can duplicate traffic to a single destination, or multiple destinations, which is called regeneration, or the TAP can provide consolidated traffic, which is referred to as aggregation.

There are a number of differences between TAPs and SPANs, but the most important in my mind is that SPAN is not a true passive solution as it creates overhead on the switch. That being said, TAPs produce a complete copy of the traffic, without this impacting the performance of the switch and knocking it over. The downside is that for you to gain access to the packets, you must do a cable swap, which could cause temporary...