[Click] Recommendation for network TAPs

[Nicholas Weaver]

On Feb 24, 2009, at 9:49 AM, Roman Chertov wrote:

> You can actually use Click to act as a tap.
>
> PollDevice(eth1)->t1 :: Tee
>                 ->Queue
>                 ->ToDevice(eth2);
>
> PollDevice(eth2)->t2 :: Tee
>                 ->Queue
>                 ->ToDevice(eth1);
>
> mirror::Queue->ToDevice(eth3);
> t1[1]->mirror;
> t2[1]->mirror;
>
>
> Then just have a node attached to eth3 that will receive and log the
> packets.  Alternatively, you can use ToUserDevice element.  In that
> case, you will just need a user level app to read/log the packets from
> ToUserDevice.  Using ToUserDevice will enable you to use the same
> machine for logging and tapping.

I would NOT recommend using Click as a tap:  A good Ethernet tap is  
"fail open": if the power dies or something happens, the network dies.

The real question is what speed network and what type of media.

For many cases, you can configure the switch itself to mirror all  
output from a port to a second ethernet.  The disadvantage is you will  
lose traffic if the duplexed data rate is above the link rate.

For 100Mbps networks, a good old fashoned ethernet HUB works wonders,  
and doesn't have the duplex issues.