NEOX NETWORKS NEOXPacketRaven Multimode Fiber TAPs User Manual

: June 10, 2024
: NEOX NETWORKS

Table of Contents

Introductions and Features
HIGHLIGHTS
Split Ratios / Light Extraction
Advanced features of the Secure Fiber TAPs
Color Coding fo the connectors
Front Panel – mobile or mounting kit / mounting frame version
Advantages of Y-Cables
Connection Reliability in case of power loss
Installation
Technical Specifications
Model Variants
Accessories
References
Read User Manual Online (PDF format)
Download This Manual (PDF format)

NEOX NETWORKS NEOXPacketRaven Multimode Fiber TAPs User Manual

Introductions and Features

Multimode Fiber TAPs are decoupling elements for passive, secure and reliable tapping of network data in optical networks. These TAPs are looped into the fibre optic line to be monitored and transmit the entire data traffic without interruption and without packet loss, while maintaining data integrity.

Using conventional SPAN ports, also called mirror ports, on the other hand, can distort the result, as this copying process works in store-and-forward mode and, for example, discards FCS/CRC faulty packets on OSI layer 2 instead of making these Ethernet frames available to the security or monitoring tool.

Our Network TAPs do not have a MAC or IP address, but work entirely on OSI Layer 1 and cannot be traced in the network without special and expensive measuring equipment. Hackers and attackers therefore have n chance. As the integrity of the outgoing data remains unaltered due to this tapping method, our Network TAPs are increasingly used in the areas of network forensics, security and monitoring.

Furthermore, Fiber TAPs do not require their own power supply and behave 100% passively in the network. Therefore, our Fiber TAPs guarantee reliable network analysis or security investigation without compromise.

This range of our PacketRaven TAPs is designed as portable TAPs. However, the TAPs can also be installed in a 19“ mounting frame in data centres via a mounting kit and support network speeds from 100Mbps to 400 Gbps.

With PacketRaven Network TAPs you get permanent network access without risk and provide e.g. your monitoring tools with 100% reliable network data – without introducing a single point of failure.

Because your network security tool is only as good as the data source!

Up to 400 Gbps
Full Network Transparency
No impairment of Data Traffic
100% Network Data
Invisible for Attackers
Flexible to Use
Plug-n-Play
Failure Protection on Power Loss
Various Split Ratios
Fast and Precise
Support Jumbo Frames
Made in Germany

HIGHLIGHTS

Supported network speeds: 100M, 1G, 2.5G, 5G, 10G, 25G, 40G, 50G, 100G, 200G and 400G
Alternative to SPAN ports – mirrors 100% of traffic including FCS/CRC erroneous packets
that may be discarded by SPANs
Invisible on the network, no IP address, no MAC address, cannot be compromised
Guaranteed no packet loss
100% passive without affecting the active network connection, no additional latency
Available in different split ratios: e.g. 50:50, 60:40, 70:30, 80:20, 90:10
No power supply needed, 100% passive
Plug-n-Play – no configuration required
Support up to 16k Jumbo Frames
Designed, assembled, certified and tested in Germany

Split Ratios / Light Extraction

In order to tap data from an optical network connection, it is necessary to decouple or split off part of the available light signal.

The split ratio is the ratio of the amount of light that is still available for the fiber network connection in relation to the amount of light that is diverted or split off to the monitoring ports of the Fiber Network TAPs.

A split ratio of e.g. 70/30 means that 70% of the light is still available for the network connection and 30% is split off for the monitoring ports.

Split Ratios / Light Extraction

Advanced features of the Secure Fiber TAPs

Optical Isolator

Secure Fiber TAPs have both an additional optical isolator (Data Diode Functionality) and an optical filter to ensure that unwanted incoming light signals are blocked at the monitoring port to protect the network from compromise.

Optical Filter

This protects your IT infrastructure from arbitrary or accidental tampering and ensures full data integrity.

They thus provide an additional security layer that offers increased protection against attackers and faulty configurations.

Advanced features of the Secure Fiber TAPs

Color Coding fo the connectors

You can see from the colours of our connectors for which fibre type the respective connector of the Network port is intended. Monitoring ports are always grey or black!

Color Coding fo the connectors

Front Panel – mobile or mounting kit / mounting frame version

Our TAPs are available with a front panel for mobile use – as well as with mounting frames (-ERW versions) for permanent installation in our PRP-1U3 server cabinet mounting frame, which provides space for three of our portable TAPs each.

Server rack mounting frame PRP-1U3 for Portable TAPs

TAP with front panel for server rack mounting frame PRP-1U3

TAP for mobile use

Of course, TAPs with mounting frames can also be used in mobile applications!

Advantages of Y-Cables

A Network TAP equipped with LC connectors has three duplex connectors, two of which are needed for looping through the network traffic to be analysed and one duplex connector for passively tapping the mirrored data for forwarding to, for example, a Network Packet Broker (NPB), an analysis system, an Intrusion Detection System (IDS), a Network Detection and Response System (NDR) or an Extended Detection and Response System (XDR).

This is the so-called monitoring port on which both the left and the right data traffic is present. These two outputs must be fed into two monitoring ports using two transceivers in order to fully receive the bi-directional traffic, as only the receive side (Rx) of the transceivers can be used for recording.

This presents a challenge because the output of the TAP is a duplex port and yet two separate ports are needed on the receive side for two individual transceivers.

To avoid this problem, it is best to use one of our special Y-cables that convert one duplex connector into two duplex connectors oriented so that the light is fed exclusively into the receiving side of the transceivers.

Advantages of Y-Cables

Connection Reliability in case of power loss

All our Fiber Network TAPs are 100% passive and do not require a power supply.
A power failure in a circuit has no effect on the TAP as it is a physical process that disconnects the network signal.
Thus, there is no impairment of the network and monitoring ports, but neighbouring devices could be affected by the power failure.

Installation

NETWORK port A is a full duplex fibre port that should be connected to one of the two network devices where network monitoring is desired.

NETWORK port B is a full-duplex fibre port that should be connected to the other side or to an adjacent network device where network monitoring is desired.

MONITOR port is a directional dual simplex port (both sides are output only) that should be connected to the input or receive side of two interfaces of one or more monitoring devices that are to capture tapped traffic.

These models in the PacketRaven Network TAPs product family are designed as portable TAPs, but can also be installed in a 19“ mounting frame in data centres using a mounting kit.

Front view – Connections and LEDs

Front view - Connections and LEDs