Frequently Asked Questions - 10/100/1G Tap

• Is the SharkTap an aggregate tap?
  • Yes, the SharkTap will 'aggregate' packets from the 'device' and 'network' ports and mirror (i.e. duplicate) them on the tap port.  If two packets are received at once they will be duplicated sequentially on the tap port. The SharkTap has a large 128KB buffer to absorb bursts of full duplex traffic.
• Does the SharkTap accept packets from the Tap port?
• As of revision E - No. It is sometimes useful to route packets from the Tap port, but since the gigabit SharkTap is often used for large networks, it was decided that the risk of corrupting the network by mistake outweighs the potential value. Any packets transmitted to the Tap port are simply dropped. Note that Wireshark may still show such packets - your PC transmitted them, even though the SharkTap dropped them.
• Does the SharkTap respond to flow control packets?
  • The Broadcom switch chip 'eats' any packet to multicast address 01:80:c2:00:00:01 (the address set aside for PAUSE frames).  There doesn't seem to be any way around this, so PAUSE packets will not be seen on the gigabit tap - you won't see them on the Tap port, and a PAUSE packet will not be forwarded to the second NETWORK port.
  • There is a second issue you might need to be aware of:  If the destination and source MAC address are the same, the packet will not be forwarded.  You WILL see the packet on the Tap port, but it won't be forwarded to the second NETWORK port.  Having a destination address equal to the source address is an invalid ethernet packet, but sometimes a software error will generate a packet of all zeros.  So you'll see this bogus packet on the Tap port, but it won't get forwarded over the network.
• Will the SharkTap show packets with bad FCS?
  • If the 4 byte IEEE 802.3 checksum at the end of the frame is bad, no, the packet will be dropped.  The SharkTap will show frames with bad checksums that are part of TCP/IP protocol.
• Is the SharkTap a hub?
  • No.  The SharkTap is a switch that is pre-configured for port mirroring, or 'sniffing'.
• Does the SharkTap support Power over Ethernet?
  • Yes, it does.  The center tap of of the isolation transformers for each pair are connected to the corresponding center tap of the other NETWORK port.  So the high speed data is blocked, but DC power is passed through.  This is done for all four pairs, so all standard PoE techniques are supported.  There are no settings, it just works.
  • If you have some unique application that must not have this DC connection between NETWORK ports, contact us (info@midbittech.com) and we can tell you how to disable PoE in the tap.
• Is there any reason to get a gigabit tap if I'm only doing 100Base-T?
  • If a full-duplex 100Base-T Network is heavily loaded, yes.  The total bits/second is the sum of both Network ports, and if that total exceeds 100Mpbs, there will be delays as packets are funneled to the 100Mbps Tap port.  Having a gigabit Tap port insures that there will be no delays monitoring a fully loaded 100Base-T network.

Back to main page