How to Integrate capture: sensor into Your Network

Preliminary Steps

SkyLIGHT capture: sensor is dedicated to analyzing the performance of business critical applications in a corporate network. Hence, the preliminary steps to be done before considering integrating SkyLIGHT capture: sensor into your network are:

• Identifying an up-to-date list of business critical applications (including applications directly supporting business processes and the applications on which these may rely, e.g., DNS, Microsoft-DS, etc.),
• Locating the servers hosting these applications, and
• Defining which network devices that clients are using to access these applications.

Positioning the Probe

The SkyLIGHT capture: sensor appliance will be installed as close as possible to the servers so as to provide the best analysis. Measurements are more accurate if the probe is in a central location next to the server. You will get a wider view of the performance experienced by all the users connecting to this server.

capture: sensor network positioning synoptic

Choosing a Traffic Capture Method

Two main methods may be used to establish a permanent point of traffic capture: TAP or SPAN. A TAP is a network device which will be installed in-line on the network and will send a copy of the traffic on one or two listening ports of the probe. A SPAN (also commonly called port mirroring) is a feature of network switches that enables a network administrator to send a copy of a given traffic on one or several interfaces / VLANs to a mirroring port.

The most commonly used method is the SPAN port (port mirroring) mainly because it enables administrators to monitor any traffic going through the switch with an existing network device. Collecting traffic through a SPAN port will likely not generate any additional points of failure on the network and will be regarded as a minor modification of its existing configuration. Network TAPs are also an option (if no SPAN is feasible, for example) but the traffic captured will be limited to the network link(s) going through the TAP. A connection via TAP incurs additional costs.

If you choose to capture network traffic through a SPAN, you should be careful not to copy the same traffic to the listening interface twice (which would degrade the statistics provided by the probe).