Network TAPs and packet brokers are the devices that copy all the traffic on a network link without slowing it, and send each copy to the right monitoring or security tool. A TAP, or test access point, is the device that makes the copy. A packet broker, also called a network packet broker or a visibility platform, receives the copies, sorts them and sends each part to the tool that needs it.
Data on a network travels in small pieces called packets. Each packet carries a small part of a web page, a video or a payment, along with the address it is going to. Many tools need to see these packets. A network detection and response (NDR) tool looks for signs of an attacker inside the network. An application monitoring tool measures how long each request takes. A recorder stores every packet, so that an incident can be studied later. None of these tools should sit in the path of the live traffic. If a tool sat in the path and failed, the traffic would stop.
The TAP solves this problem. It is fitted on a cable, often a fibre between two data centre switches. On a fibre, a passive TAP uses a small optical splitter. It sends, say, 70% of the light onward, and 30% to a separate output. Because it needs no power, the live traffic continues even if the TAP fails. The output is an exact copy of everything on that cable.
But the copies are too many and too large for the tools. Consider a telecom operator's data centre in Noida. The operator fits TAPs on 40 links, each carrying up to 100 gigabits per second. Its NDR tool can study only 20 gigabits per second, and its video quality tool needs only video traffic. The packet broker receives all 40 copies. It removes duplicates, because the same packet is often copied on two links. It keeps only the traffic that each tool needs, such as video for the video tool. Most packets are encrypted, so their contents cannot be read anyway. For those, the broker cuts off the contents and keeps only the header, the first part of each packet, which holds the addresses and timing. It also spreads the load across three NDR machines, so that none of them is overloaded. In the end, each tool receives only the copies it needs, at a rate it can handle.
Brokers can do more. Where the law and the company's own rules allow it, they can decrypt traffic for a security tool. They can add a precise time to each packet, which matters when engineers measure delays in thousandths of a second.
Besides NDR tools, the copies go to the observability platform, which uses them to time requests, and to the SIEM, which keeps records of the traffic for the security team. Tools that check the traffic passing through the firewall can use them too.
How is a TAP different from a port mirror? Most switches can copy the traffic of one port to another port, which is called port mirroring, or SPAN. It costs nothing extra. But a busy switch may drop some of the copies when it is overloaded. A TAP copies every packet, every time. That is why telecom operators and banks use TAPs on their most important links.