Frequently Asked Questions - 10/100/1G Tap
- Does the SharkTap handle jumbo frames?
- The SharkTap will handle frames up to 9072 bytes long.
- Does the SharkTap respond to flow control packets?
- The Broadcom switch chip 'eats' any packet to multicast address 01:80:c2:00:00:01 (the address set aside for PAUSE frames). There doesn't seem to be any way around this, so PAUSE packets will not be seen on the gigabit tap - you won't see them on the Tap port, and a PAUSE packet will not be forwarded to the second NETWORK port.
- There is a second issue you might need to be aware of: If the destination and source MAC address are the same, the packet will not be forwarded. You WILL see the packet on the Tap port, but it won't be forwarded to the second NETWORK port. Having a destination address equal to the source address is an invalid ethernet packet, but sometimes a software error will generate a packet of all zeros. So you'll see this bogus packet on the Tap port, but it won't get forwarded over the network.
- Does the SharkTap accept packets from the Tap port?
- As of revision E - No. It is sometimes useful to route packets from the Tap port, but since the gigabit SharkTap is often used for large networks, it was decided that the risk of corrupting the network by mistake outweighs the potential value. Any packets transmitted to the Tap port are simply dropped. Note that Wireshark may still show such packets - your PC transmitted them, even though the SharkTap dropped them.
- Is the SharkTap an aggregate tap?
- Yes, the SharkTap will 'aggregate' packets from the 'device' and 'network' ports and mirror (i.e. duplicate) them on the tap port. The SharkTap, like any switch, is a 'store and forward' device - it receives a packet in full, and then re-transmits it. If two packets are received at once they will be duplicated sequentially on the tap port.
- What about a passive tap?
- A passive tap gives the most time accurate view of a connection, but it's not the most convenient tap. You need two ports on your PC, for starters, one for transmit data and one for receive data. A passive tap will generally not support auto-configuration, so it requires more care to set up your ports. The SharkTap is designed to be convenient, and it's rare to need precise time stamping of packets. Note also that it is impossible to passively monitor gigabit ethernet: Each end transmits simultaneously, and each end subtracts what it sends from what it receives in order to determine what the other end sent. So a 'passive tap' for gigabit ethernet still has to break the link.
- Is the SharkTap a hub?
- No. There seems to be a lot of confusion over 'hub', but a hub is really an obsolete technology. A hub was sort of like a passive monitor in that any traffic was instantly duplicated on all ports, so you could use a hub to monitor a network connection. But you have a hard time finding one any more, they have been replaced by switches.
- Does the SharkTap support Power over Ethernet?
- Yes, it does. The center tap of of the isolation transformers for each pair are connected to the corresponding center tap of the other NETWORK port. So the high speed data is block, but DC power is passed through. This is done for all four pairs, so all standard PoE techniques are supported. There are no settings, it just works.
If you have some unique application that must not have this DC connection between NETWORK ports, contact us (email@example.com) and we can tell you how to disable PoE in the tap.
- Is there any reason to get a gigabit tap if I'm only doing 100Base-T?
- If a full-duplex 100Base-T Network is heavily loaded, yes. The total bits/second is the sum of both Network ports, and if that total exceeds 100Mpbs, there will be delays as packets are funneled to the 100Mbps Tap port. Having a gigabit Tap port insures that there will be no delays monitoring a fully loaded 100Base-T network.
Back to main page