Owner manual

10/100 to Triple-speed Port Aggregator
6
Application Diagrams: Memory Operation
All trafc that passes through the Tap is sent to the monitoring device NIC on
a rst-in, rst-out basis, including trafc that is temporarily stored in memory.
If two packets enter at the same time then one packet is processed while the
other is stored briey in memory, preventing collisions.
When there is a burst of data, trafc in excess of the NIC's capacity is sent to
the Tap's memory. Up to one gigabyte of data from the full-duplex stream can
be stored in memory. Memory continues to ll until its capacity is reached, or
the burst ends – whichever comes rst.
In both cases, the Tap applies a rst-in, rst out procedure, processing stored
data before new data from the link. If memory lls before the burst ends, the
memory stays lled as the stored data is processed – data that leaves the buffer
is immediately replaced. If the burst ends before the memory lls, memory
clears until the full gigabyte of capacity is available, or until another burst in
excess of the NIC's capacity requires additional memory.
The following three diagrams illustrate a simple example of a 100 Mbps NIC
moving from 80 percent utilization, to 140 percent utilization, then back to 80
percent utilization.
State 1: Side A + Side B is less than or equal
to 100% of the NIC's receive utilization
FirewallRouter
Monitoring
Device 1
1
10/100 to
Triple-speed
Port Aggregator
Using a single NIC each, both
monitoring devices receive all
combined traffic from Side A
and Side B, including physical
layer errors.
Side A
30 Mbps
Side B
50 Mbps
Side A + Side B
80 Mbps
Side A + Side B
80 Mbps
Example: On a 100 Mbps link, Side A is at 30 Mbs and Side B
is at 50 Mbps. The NIC receives 80 Mbps of traffic
(80% utilization), so no memory is required for the
monitoring device NIC to process all full-duplex traffic.
Monitoring
Device 2
B 21A
96443
Figure 2: 80% Utilization