Cool News Taps from Net Optics

You know I am always on the prowl for new networking gear to perform network security monitoring. In fact, I may write a whole new book about the subject, pulling enterprise network instrumentation coverage from future editions of The Tao and other books and concentrating it in a single volume.

In the spirit of sharing information on new gear, I am happy to let you know about two cool new products from Net Optics. The first is the 10/100 Teeny Tap, pictured above. This is a fully-functional, dual-power, dual output traditional 10/100 Mbps tap. It's functionally equivalent to the 10/100 Ethernet Tap.

The second neat product is the iTap Gigabit Dual Port Aggregator. This is a Gigabit tap that provides two outputs where each are combinations of the two TX input streams. This tap is similar to the Gigabit Dual Port Aggregator with several major differences, which I noted last month. I ran some traffic through this tap today and I really liked seeing the traffic load on the LCD screen. I did not get a chance to try the remote management features, but I plan to soon.

I took some photos of the Teeny Tap sitting above a traditional Ethernet tap, on top of the copper iTap. (There will also be a fiber iTap.) You can see just how tiny the Teeny Tap is. You can also buy the Teeny Tap online. It ships with a smart black canvas carrying case that looks like a digital camera container. It is big enough to hold the tap and two power supplies, along with some cables. I intend to take one with me on all of my engagements.

Thank you to Net Optics for sharing these with me. Who in your organization could use a Teeny Tap? I'm sure any consultants who travel as frequently as I do with a laptop bag would love to replace their existing setup with a Teeny Tap. As for the iTap, expect to see more of these everywhere -- the statistical functions are awesome.

Comments

Anonymous said…
My Teeny Tap carrying case even came with a lens cleaner :)
6:05 PM
JimmytheGeek said…
They didn't happen to send you a spare, did they?
4:56 PM
Richard Bejtlich said…
Spare? Can you elaborate?
5:50 PM
Anonymous said…
Curious if you've ever had a chance to evaluate Gigamon's product? It would appear to make the iTap look pretty tame.
12:26 AM
Richard Bejtlich said…
I saw Gigamon at RSA, but I have not used it personally. Gigamon has nothing to do with an iTap. Even price-wise, a basic Gigamon box is close to $20,000. An iTap is probably 5-10% of that price.
6:49 AM
Anonymous said…
Gigamon is in a different class that the iTap no doubt, but I wouldn't say it has "nothing" to do with it. If you are trying to tap a network in several locations and monitor those several locations with a single set of tools, Gigamon would appear to be the only game in town. I'd be happy to hear of alternatives though.
1:03 AM
Richard Bejtlich said…
Link aggregator taps can bring together feeds from multiple smaller bandwidth lines and present the output to one or more high bandwidth sensors.
7:48 AM
Anonymous said…
A link aggregator in combination with a regeneration tap. Is there anyone besides Gigamon out there that can tap up to 6 gig connections and feed up to 8 tools in any software-reconfigurable combination (with the ability to filter on port, vlan, etc in defining these mappings) in one box, or stacked together with some sort of fast interconnect? I'd certainly be interested in hearing of them.
3:51 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more