Black Box TS230A-R2 User manual

Provides access to the data streams passing
through a high-speed network device and a
switch.
Models available to monitor both copper and optical links.
Order toll-free in the U.S.: Call 877-877-BBOX (outside U.S. call 724-746-5500)
FREE technical support 24 hours a day, 7 days a week: Call 724-746-5500 or fax
s-AILINGADDRESS"LACK"OX#ORPORATION0ARK$RIVE,AWRENCE
0!s7EBSITEWWWBLACKBOXCOMs%MAILINFO BLACKBOXCOM
Customer
Support
Information
-ARCH
codes codes
codes codes
codes codes
.ETWORK4!0S4EST!CCESS0ORTS
43!2 43! 43!
43!2 43! 43!
43! 43! 43!
43! 43

3
FEDERAL COMMUNICATIONS COMMISSION and INDUSTRY CANADA
RADIO FREQUENCY INTERFERENCE STATEMENTS
This equipment generates, uses, and can radiate radio-frequency energy, and if not installed and
used properly, that is, in strict accordance with the manufacturer’s instructions, may cause
interference to radio communication.
It has been tested and found to comply with the limits for a Class A computing device in
accordance with the specifications in Subpart B of Part 15 of FCC rules, which are designed to
provide reasonable protection against such interference when the equipment is operated in a
commercial environment. Operation of this equipment in a residential area is likely to cause
interference, in which case the user at his own expense will be required to take whatever
measures may be necessary to correct the interference.
Changes or modifications not expressly approved by the party responsible for compliance
could void the user’s authority to operate the equipment. This digital apparatus does not
exceed the Class A limits for radio noise emission from digital apparatus set out in the Radio
Interference Regulation of Industry Canada.
Le présent appareil numérique n’émet pas de bruits radioélectriques dépassant les limites
applicables aux appareils numériques de la classe A prescrites dans le Règlement sur le
brouillage radioélectrique publié par Industrie Canada.
Normas Oficiales Mexicanas (NOM)
Electrical Safety Statement
INSTRUCCIONES DE SEGURIDAD
1Todas las instrucciones de seguridad y operación deberán ser leídas antes de que el aparato
eléctrico sea operado.
2Las instrucciones de seguridad y operación deberán ser guardadas para referencia futura.
3Todas las advertencias en el aparato eléctrico y en sus instrucciones de operación deben ser
respetadas.
4Todas las instrucciones de operación y uso deben ser seguidas.
5El aparato eléctrico no deberá ser usado cerca del agua-por ejemplo, cerca de la tina de
baño, lavabo, sótano mojado o cerca de una alberca, etc..
6El aparato eléctrico debe ser usado únicamente con carritos o pedestales que sean
recomendados por el fabricante.

7El aparato eléctrico debe ser montado a la pared o al techo sólo como sea recomendado por
el fabricante
8Servicio-El usuario no debe intentar dar servicio al equipo eléctrico más allá a lo descrito
en las instrucciones de operación. Todo otro servicio deberá ser referido a personal de
servicio calificado.
9El aparato eléctrico debe ser situado de tal manera que su posición no interfiera su uso. La
colocación del aparato eléctrico sobre una cama, sofá, alfombra o superficie similar puede
bloquea la ventilación, no se debe colocar en libreros o gabinetes que impidan el flujo de
aire por los orificios de ventilación.
10 El equipo eléctrico deber ser situado fuera del alcance de fuentes de calor como radiadores,
registros de calor, estufas u otros aparatos (incluyendo amplificadores) que producen calor.
11 El aparato eléctrico deberá ser connectado a una fuente de poder sólo del tipo descrito en
el instructivo de operación, o como se indique en el aparato.
12 Precaución debe ser tomada de tal manera que la tierra fisica y la polarización del equipo
no sea eliminada.
13 Los cables de la fuente de poder deben ser guiados de tal manera que no sean pisados ni
pellizcados por objetos colocados sobre o contra ellos, poniendo particular atención a los
contactos y receptáculos donde salen del aparato.
14 El equipo eléctrico debe ser limpiado únicamente de acuerdo a las recomendaciones del
fabricante.
15 En caso de existir, una antena externa deberá ser localizada lejos de las lineas de energia.
16 El cable de corriente deberá ser desconectado del cuando el equipo no sea usado por un
largo periodo de tiempo.
17 Cuidado debe ser tomado de tal manera que objectos liquidos no sean derramados sobre la
cubierta u orificios de ventilación.
18 Servicio por personal calificado deberá ser provisto cuando:
AEl cable de poder o el contacto ha sido dañado; u
BObjectos han caído o líquido ha sido derramado dentro del aparato; o
CEl aparato ha sido expuesto a la lluvia; o
DEl aparato parece no operar normalmente o muestra un cambio en su desempeño; o
EEl aparato ha sido tirado o su cubierta ha sido dañada.

5
rev. 1
Contents
Chapter 1: TAPs Overview
Security, convenience, and dependability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Deciding whether to use a TAP or a SPAN/mirror port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Choosing between a SPAN, Aggregator, or full-duplex TAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
When to use a SPAN/mirror port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
When to use an Aggregator TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
When to use a full-duplex TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Chapter 2: Copper TAPs
Major features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Standard and optional parts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Installing the Copper TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Ports, LEDs, and power connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Interpreting the Link and Speed LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
10/100 TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
10/100/1000 TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Technical specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Chapter 3: Optical TAPs
Major features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Standard and optional parts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Installing the Optical TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Attenuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Attenuation and TAPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Determining the best split ratio for you . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Attenuation and optical cables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Managing attenuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Technical specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Chapter 4: Aggregator TAPs
Major features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Standard and optional parts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Choosing an Aggregator TAP buffer size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Installing the Copper Aggregator TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Ports, LEDs, and power connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

6
rev. 1
Interpreting the Link and Speed LEDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Connection sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Chapter 5: FAQ and Troubleshooting
What happens if my TAP loses power? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
What latency does a TAP create?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Are the analyzer ports “send only”? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Can I daisy chain an Aggregator TAP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Can I “team” NICs in my analyzer?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
How do I connect my failover devices?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Not seeing traffic at the analyzer from the TAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Choosing crossover or straight-through cables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
I am seeing CRC errors on my network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
VLAN tags not visible at the analyzer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Chapter 1 TAPs Overview
7
rev. 1
Chap ter 1
TAPs Overview

Security, convenience, and dependability
Chapter 1 TAPs Overview
8
rev. 1
Thank you for purchasing the TAP: the most robust, secure, and
convenient mechanism for network analyzers and similar devices to
copy data streams from high-capacity network links.
A network Test Access Port (TAP) provides access to the data streams
passing through a high-speed, full-duplex network link (typically
between a network device and a switch. The TAP copies both sides of
a full-duplex link (copper or optical, depending on type of TAP), and
sends the copied data streams to an analyzer, probe, intrusion
detection system (IDS) or any other passive analysis device. There are
different TAP models available to monitor both copper and optical
links.
Security, convenience, and dependability
The security and convenience of a TAP makes it preferable to inline
connections for network analysis and intrusion detection and
prevention (IDS/IPS) applications. Because a TAP has no address on
the network, the TAP and the analyzer connected to it cannot be the
target of a hack or virus attack. TAPs are economical to install,
allowing you to leave them permanently deployed. This allows you to
connect and disconnect the analysis device as needed without
breaking the full-duplex connection, much like plugging in an
electrical device.
A TAP is also preferable to using a switch’s SPAN/mirror port to copy
the data stream. Unlike the SPAN/mirror port, a TAP will not filter
any errors from the data stream. Also, because a SPAN/mirror port is a
half-duplex link (that is, a send-only “simplex” data stream), it has the
capacity to transmit only half of a fully-saturated link. Additionally, a
TAP does not use any of the switch’s CPU resources.
Deciding whether to use a TAP or a SPAN/mirror port
A TAP is a passive splitting mechanism installed between a device of
interest and the network. A TAP copies the incoming network traffic
and splits it. It passes the network traffic to the network and sends a
copy of that traffic (both send and receive) to a monitoring device in
real time. A switch cannot pass physical layer errors (poorly formed
packets, runts, CRCs) to the analyzer, but a TAP will.

Deciding whether to use a TAP or a SPAN/mirror port
Chapter 1 TAPs Overview
9
rev. 1
Most enterprise switches copy the activity of one or more ports
through a Switch Port Analyzer (SPAN) port, also known as a mirror
port. An analysis device can then be attached to the SPAN port to
access network traffic.
Use Figure 1 and Tab le 1 to determine whether to use a TAP or a
SPAN/mirror port.
Figure 1 TAP versus SPAN

Choosing between a SPAN, Aggregator, or full-duplex TAP
Chapter 1 TAPs Overview
10
rev. 1
Choosing between a SPAN, Aggregator, or full-duplex
TAP
There are numerous ways to access full-duplex traffic on a network
for analysis: SPAN/mirror ports, Aggregator TAPs, or full-duplex TAPs
are the three most common. Which you use depends on the saturation
level of the link (up to 200% of link speed when both sides are
combined) you want to monitor and the level of visibility you require.
Each approach has advantages and disadvantages. SPANs and
Aggregator TAPs are designed to work with a standard (and usually
less expensive) network card on the analysis device, but their
limitations make them less than ideal for situations where it is
necessary to guarantee the visibility of every packet on the wire.
A full-duplex TAP is the ideal solution for monitoring full-duplex
networks utilized at more than 50 percent (100% when both sides are
Table 1 Pros and Cons of TAPs and SPANs
TAP SPAN/mirror port
Pros Eliminates the risk of dropped packets Low cost
Monitoring device receives all packets,
including physical errors
Remotely configurable from any system
connected to the switch
Provides full visibility into full-duplex networks Able to copy intra-switch traffic
Cons Analysis device may need dual-receive capture
interface if you are using a full-duplex TAP
(does not apply to Aggregator TAPs)
Cannot handle heavily utilized full-duplex links
without dropping packets
Additional cost with purchase of TAP hardware Filters out physical layer errors, hampering
some types of analysis
Cannot monitor intra-switch traffic Burden placed on a switch’s CPU to copy all
data passing through ports
Switch puts lower priority on SPAN port data
than regular port-to-port data
Can change the timing of frame interaction
altering response times
Bottom
line
A TAP is ideal when analysis requires seeing all
the traffic, including physical-layer errors. A
TAP is required if network utilization is
moderate to heavy. An Aggregator TAP can be
used as an effective compromise between a
TAP and SPAN port, delivering some of the
advantages of a TAP and none of the
disadvantages of a SPAN port.
A SPAN port performs well on low-utilized
networks or when analysis is not affected by
dropped packets.