A Network TAP (Test Access Point) is a small hardware device inserted directly into a network cable. It copies all the traffic passing through it and sends that copy to monitoring tools, while the live traffic keeps flowing untouched. A TAP works at the physical layer — the level of the raw signal on the wire. It passes the original packets between two devices and, at the same time, hands a duplicate to analysis tools such as packet sniffers, intrusion detection and prevention systems (IDS/IPS), NDR platforms (which watch network traffic for threats), and forensic systems.
How does a Network TAP work?
A TAP is deployed in-line, in the break of an existing cable between two points in the network — for example, between a switch and a router. All traffic physically passes through the device, and along the way the TAP copies both directions of the conversation (full-duplex, meaning data flowing both ways at once) onto separate monitoring ports. Because copying happens at the signal level, the monitoring tool gets an exact picture of the traffic — including malformed frames, checksum (CRC) errors, and odd-sized packets that active network devices usually drop silently.
The behavior differs slightly by media:
- Fiber (optical) TAP — uses a passive optical splitter that divides the light beam at a fixed ratio (for example 50/50, 60/40, 70/30) between the production link and the monitoring port. It needs no power and adds no processing latency.
- Copper TAP — for twisted pair (10/100/1000BASE-T) it regenerates the electrical signal and therefore usually requires power. Well-designed units include a fail-safe (relay bypass) that shorts the pass-through link on power loss so production traffic keeps flowing.
What are the types and modes of Network TAP?
TAPs are classified by power requirement and by how they output traffic:
- Passive TAP — typically optical; requires no power to copy traffic, so it adds no power-related single point of failure. Ideal for out-of-band monitoring.
- Active TAP — powered; required for copper and where extra functions are needed (aggregation, regeneration, filtering, buffering). It must be protected against power loss.
- Breakout TAP (1:1) — the most common mode; each direction of the full-duplex stream goes to a separate monitoring port, avoiding oversubscription and dropped packets.
- Aggregation TAP (M:1) — combines multiple streams (for example both directions of several links) onto a single output port; convenient, but at peak load it can exceed the output port capacity and drop packets, so it uses buffering.
- Regeneration TAP (1:M) — replicates the copy of one link onto multiple ports to feed several monitoring tools at once.
- Bypass TAP — for in-line appliances (IPS, firewall, WAF); it sends heartbeat packets to the security device and, on detecting failure, automatically bypasses it (fail-open) to keep the link up.
How is a Network TAP different from SPAN (port mirroring)?
SPAN (Switch Port Analyzer, also known as port mirroring) is a switch feature that copies traffic from selected ports or VLANs to a monitoring port. It is free and remotely configurable, but it has significant limitations compared with a TAP:
- Traffic priority — a switch’s primary job is forwarding production traffic; SPAN copies have lower priority and are dropped first under load.
- Oversubscription — SPAN usually aggregates multiple full-duplex links onto a single port of the same speed, so it is easily overloaded and drops packets.
- Copy fidelity — the switch normalizes traffic and discards corrupted frames and physical-layer errors; SPAN hides many anomalies a TAP would show. It may also reorder packets or alter timestamps.
- Device overhead — generating copies consumes switch resources and can affect production performance.
A TAP provides a 1:1 copy at the physical layer, independent of device load. SPAN is useful for ad hoc monitoring, accessing intra-switch traffic (port-to-port, same VLAN), and locations where no TAP is installed.
Why does a Network TAP matter for security?
Effective threat detection and incident analysis require complete, unaltered network telemetry. A TAP delivers it in a way SPAN cannot guarantee:
- Evidentiary completeness — network forensics and attack reconstruction depend on every packet; missing traffic at peak load (typical for SPAN) can hide a data-exfiltration phase or C2 traffic.
- Feeding NDR/IDS sensors — NDR and IDS systems (e.g., Suricata, Zeek) analyze a copy of traffic passively; a TAP gives them east-west and north-south visibility without touching the production path.
- Invisibility to attackers — a passive TAP has no IP/MAC address in the monitored segment and generates no traffic, so it is practically undetectable and hard to evade from a compromised host.
- No impact on availability — a passive or fail-safe TAP does not become a single point of failure for the link, which is critical in high-availability segments.
- Compliance and audit — regulations and policies that mandate monitoring of all traffic in a segment (including lawful intercept) realistically require the faithful copy a TAP provides.
TAPs are most often placed at boundaries: internet uplinks, in front of and behind firewalls, data-center uplinks, and critical segments where the SOC needs continuous visibility.
Learn more
- NSM (Network Security Monitoring) — Network TAPs provide passive traffic copies used by NSM tools for security analysis.
- NPM (Network Performance Monitoring) — Network TAPs feed NPM systems with traffic data to measure latency, loss, and throughput.
- Probe (Sonda) — A probe can collect traffic from a Network TAP for monitoring and packet analysis.
