Network Tapping System

• The Network Tapping System is one of the most important network systems. It takes a copy of all the networking events and sends it to the served system to be monitored and analyzed

It is a hardware device which provides a way to access the data flowing across a computer network.
In many cases, it is desirable for a third party to monitor the traffic between two points in the network.
If the network between points A and B consists of a physical cable, a "network tap" may be the best way to accomplish this monitoring.
The network tap has (at least) three ports: an A port, a B port, and a monitor port.
A tap inserted between A and B passes all traffic (send and receive data streams) through unimpeded in real time, but also copies that same data to its monitor port, enabling a third party to listen.
Network taps are commonly used for network intrusion detection systems, VoIP recording, network probes, RMON probes, packet sniffers, and other monitoring and collection devices and software that require access to a network segment.
Taps are used in security applications because they are non-obtrusive, are not detectable on the network (having no physical or logical address), can deal with full-duplex and non-shared networks, and will usually pass through or bypass traffic even if the tap stops working or loses power.
https://en.wikipedia.org/wiki/Network_tap

• Port Mirroring, also known as SPAN (Switched Port Analyzer), is a method of monitoring network traffic. With port mirroring enabled, the switch sends a copy of all network packets seen on one port (or an entire VLAN) to another port, where the packet can be analyzed.

Conclusion: With a regular switch the network traffic is visible only to computers, which directly participare in a communication. Other computers do not see the traffic, that is not destined for them.

this switch supports port mirroring function. And administrator has configured the switch to mirror to computer D all network packets, which are transmitted between computers A and B.
Computer D is a listener to the traffic. Computer D can be used for network logging or call recording if we have IP phones instead of computers A and B .
Conclusion: Port mirroing allows a particular computer to see the network traffic, which is normally hidden from it.

In this example, one of IP Phones makes a call to a remote phone outside of the local network (whether it is analog phone, cellular or another IP Phone).
Network traffic from IP Phone goes through network switch with port mirroring. The switch sends to MiaRec a copy of every network packet, sent or received by IP Phone.
By using intelligent packet capturing technology, MiaRec detects Voip-related packets inside the network traffic, decodes them and saves audio on a disk.

https://www.miarec.com/faq/what-is-port-mirroring

• A network tap is an external monitoring device that mirrors the traffic that is passing between network nodes. A tap (test access point) is a hardware device inserted at a specific point in the network to monitor specific data. As part of the Gigamon Visibility Platform, network TAPs provide the visibility required to secure, monitor and manage your enterprise network infrastructure continuously and efficiently.

Passive optical TAPs are the ultimate source of truth for data in motion on the network because they create perfect copies of all traffic at full bandwidth. They require no power or management and do not actively interact with other components of the network. Gigamon offers several passive optical TAP solutions:

Active TAPs are used in networks where copper cabling or optical budgets do not allow for passive TAPs. In the event of a power failure, active TAPs have battery backup to keep them running and will send an alert to indicate the failure. A bypass TAP is a type of active TAP that also has a relay that closes when it loses power, maintaining the network connection and minimizing disruption to traffic.

https://www.gigamon.com/products/visibility-nodes/network-taps.html

• Moloch augments your current security infrastructure by storing and indexing network traffic in standard PCAP format, while also providing fast indexed access. Moloch is not meant to replace Intrusion Detection Systems (IDS), instead it provides more visibility. Moloch is built with an intuitive UI/UX which reduces the analysis time of suspected incidents.

https://molo.ch/