Network TAP

A Network TAP is fundamentally a passive device that requires no external power to maintain the live network link. In the event of a complete power loss to the TAP itself, the primary network connection between endpoints remains fully intact and uninterrupted. This is achieved through internal relays or optical splitters that physically bypass the monitoring circuitry during a failure, ensuring that security monitoring infrastructure can never become a single point of failure for critical industrial control system (ICS) traffic.

Unlike a SPAN (Switched Port Analyzer) port, which relies on a switch's CPU to copy packets and can introduce variable latency or drop packets during high load, a TAP operates at Layer 1 (Physical Layer). It creates an exact, instantaneous duplicate of the electrical or optical signal. This guarantees zero additional latency and zero packet loss on the monitoring output, which is critical for capturing the precise inter-packet timing required to analyze deterministic industrial protocols like GOOSE messages in IEC 61850 substation networks.

A SPAN port often struggles to copy both directions of a full-duplex link simultaneously without oversubscription. A TAP inherently splits the bidirectional traffic into two separate monitoring ports (one for TX, one for RX), providing complete full-duplex visibility without merging streams. Furthermore, because a TAP replicates the physical signal, it passes through physical layer errors—such as malformed frames, CRC errors, and runt packets—to the monitoring tool. These errors are often stripped by a switch's SPAN function but are vital for forensic analysis and intrusion detection.

The implementation varies by media type:

• Fiber Optic TAPs: Use passive optical splitters to divide a light signal at a fixed ratio (e.g., 70/30). They require no power and introduce no electromagnetic interference, making them ideal for high-voltage substation environments.
• Copper (RJ45) TAPs: Use active relay circuits to replicate electrical signals. While they require power for the monitoring port, the fail-safe relays ensure the live link remains a closed circuit even if the TAP loses power, maintaining the physical connection between critical endpoints like PLCs and engineering workstations.

Advanced TAPs offer intelligent processing modes beyond simple splitting:

• Aggregation TAP: Combines the TX and RX traffic from a full-duplex link into a single monitoring port, allowing a tool with a single NIC to see the entire conversation. This requires careful sizing to ensure the aggregated traffic does not exceed the monitor port's bandwidth.
• Regeneration TAP: Takes a single input stream and creates multiple identical copies, allowing simultaneous analysis by a Security Information and Event Management (SIEM) system, an Intrusion Detection System (IDS), and a forensic recorder without contention.

In OT security architectures, TAPs are strategically placed at the Industrial Demilitarized Zone (IDMZ) boundary to monitor north-south traffic between the enterprise IT network and the operational ICS network. Placing a TAP on the critical link between a SCADA server and a remote terminal unit (RTU) allows a passive monitoring platform like Zeek to perform deep packet inspection on DNP3 or Modbus TCP traffic without ever risking a security tool actively injecting a packet into the control plane, thus maintaining strict IEC 62443 zone separation.