Skip to main content
The LARK monitors network traffic passively. It receives a copy of traffic and analyzes it without sitting inline, so it never interrupts or slows the traffic it observes. This page covers the delivery of that copy to the appliance’s TAP Ingress Port.

The capture path

Traffic reaches the appliance through a capture path that terminates at the TAP Ingress Port. In the simplest case, a single source is connected directly; where traffic is collected from several points, an aggregator combines them first. The general path is: Traffic source (TAP or SPAN) → optional aggregator → TAP Ingress Port
The appliance receives only a copy of traffic. The live network is never routed through the appliance, so connecting it places no production traffic at risk.

Traffic sources

A copy of traffic may be obtained from either of two common sources:

Network TAP

A TAP is installed on the link to be observed and produces a copy of the traffic crossing it. The live link continues to pass through the TAP without interruption, while the TAP’s monitor ports send a copy to the appliance. TAPs provide a complete, reliable copy and are the preferred source.

Switch SPAN (mirror) port

Many switches can mirror traffic from one or more ports to a designated SPAN (mirror) port. Connecting that mirror port to the appliance is a straightforward means of delivering traffic where a TAP is not in place.
With breakout-style TAPs, each direction of a link may be presented on a separate monitor port. Both directions should be delivered to the appliance so the full conversation is captured, combined at an aggregator where required.

Using an aggregator

Where traffic is collected from more than one source simultaneously, a TAP aggregator combines those feeds into a single stream before it reaches the appliance. The monitor outputs from the TAPs or SPAN ports are connected to the aggregator, and the aggregator’s output is connected to the TAP Ingress Port. An aggregator is required only when combining multiple sources. A single TAP or SPAN port connects to the TAP Ingress Port directly.

Connecting to the TAP Ingress Port

The final connection in the capture path is to the appliance’s TAP Ingress Port, the interface dedicated to incoming traffic for monitoring. The single source, or the aggregator’s combined output, is connected to the TAP Ingress Port using media that matches the interface.
Traffic to be monitored must be connected to the TAP Ingress Port specifically. The rear interface serving as the TAP Ingress Port depends on the appliance’s configuration; the interface configurations page identifies it. Connecting the traffic source to any other interface prevents the appliance from observing it.