Had a meeting today and someone clued me into the existance of VSS Monitoring makes taps that use a hashing algorithm to distribute the load of 10G taps across several monitoring ports. This method ensures that all the packets of a TCP session is distributed to the same monitoring port. This is much like what stream capable cards from vendors such as Endace and Napatech perform. This definately caught my attention as this is the first tap I have seen with this level of functionality. In my previous post I wrote about using a single stream capable card that uses a hashing algorithm to be combined with Daemonlogger and quite a few quad head network cards to create a “traffic splitter”. Well it appears VSS Monitoring has actually already created a tap to do just this. I don’t know about the pricing of the devices (standard tap, a stream capable card and commodity server/nics is probably going to be cheaper) but stripped down specialized hardware can have its advantages. Here is a podcast they did outlining the functionality of the taps:
Unfortunately you have to dig into this level to see that this is the functionality and even in the podcast they keep going over filtering. They go over what load balancing is on their site, but they do not have a list of which of their taps support it. As best I can tell, any 10G capable distributed tap they sell has this functionality.
With a couple exceptions, all of VSS 10-Gigabit and 1-Gigabit distributed taps support load balancing. The link you provided in your post lists them: http://www.vssmonitoring.com/products/d_taps.asp
More information is in our Load Balancing whitepaper, available from: csupport@vssmonitoring.com
You can also sign up for our RSS feed: http://www.vssmonitoring.com/rss.xml