TAP & Network Packet Broker

What is TAP and Network Packet Broker (NPB)?

Traffic extraction equipment (TAP) is a virtualization device or software placed on the transmission line or in a virtualization system to extract data on the network, in the system to monitoring devices or NPB.

Network Packet Broker (NPB) is a tool specialized in separating and aggregating network traffic taken from TAP devices and processing them and then sending the post-processing data to analytics tools without affecting performance. network system.

The Importance of Network Packet Broker

As networks become increasingly decentralized and information needs to be collected more and more, it is essential to have a solution that assists in collecting, aggregating and processing them before being pushed through surveillance systems. , data analysis.

Distributed network assessment helps businesses gather more information, as well as have an overview and converge the necessary information in a single centralized system. Helping businesses save operating costs, enhance security across the entire system.

 

Some key features of Network Packet Broker:

1 / Provide the ability to filter multiple parameters simultaneously:

NPB device provides the ability to filter multiple components simultaneously from layer 2 to layer 7 (filter by VLAN, by IP address, by port, by application, by geographic partition …) to help filter the data stream accordingly. for each device, analysis tool, reducing processing need on those devices.

Traffic cloning:

Copies traffic from one input port to multiple output ports, allowing data coming from one source to be sent to multiple analyzers. Reduces the need for ports to connect to that source (does not need multiple SPAN ports on a single physical device) thereby reducing the hardware requirements of network devices.

 

2 / Combine flow:

Consolidation of traffic from multiple sources to send to the analyzer reduces the ports needed to connect to the analyzer, reducing hardware requirements on the analyzer.

Vlan Tag, IxFlow, Packet capture:

Works with packets that have a Vlan tag assigned. Create IxFlow (NetFlow + Metadata) with information such as area IP, latitude and city name, and include application ID or name, device, browser and even SSL encryption. In addition, the device also supports the Packet Capture feature.

 

3 / Load Balancing:

  • The device is capable of transferring traffic to many different devices to balance the load, reducing the processing performance for data processing equipment.

Packet stack feature:

  • NPB supports the following features: Deduplication, Header stripping, Trimming, Data Masking, Timestamping, Burst Protection
  • Features SSL inspection
  • NPB supports SSL decryption with both Inline Active (for devices like IPS) and Inline Passive (IDS, APT) models.
  • Real-time display of network traffic:
  • NPB equipment handles network traffic and real-time display, allowing monitoring and operation personnel to capture information instantly.
  • Update security features monthly.
  • Other features include integration with Radius authentication devices, tacacs +, surveillance devices that use SNMP or support for the syslog protocol to eject SIEM devices.

INFORMATION SOLUTION DISTRIBUTOR:


Netscout