Link Aggregation

Link Aggregation is a technology that combines a bi-directional full duplex data transmission into one single stream of data. An identical copy of this single stream of data can then be sent to any connected monitoring device. The connected monitoring device can receive the entire full duplex conversation with a single network interface card (NIC).

Link Aggregation differs from traditional In-Line monitoring with network taps or SPAN ports because those methods transmit full duplex traffic in independent streams of data to the monitoring device. The connected monitoring device must then have a dual-receive monitor card capable of receiving both sides of the full duplex conversation and the ability to aggregate the traffic internally once it is received.

Because each tap/monitoring port on a link aggregation tap sends output to a single port on a monitoring device, this effectively doubles the port capacity of monitoring devices with two NICs (i.e. only one of two ports is used).

In addition, link aggregation allows for the continued use of existing, legacy, and popular open source tools (such as Snort®) that may not support dual receive monitoring or be able to reassemble full duplex network traffic.