Passive visibility for OT networks. A network TAP copies the traffic on a link to your monitoring tools, with no path back into the network.
SKU:P1GCCB
Vendor:
SKU:P1GCCAS
Vendor:
SKU:INT1G10CSA
Vendor:
SKU:INT1G10CSASP
Vendor:A network TAP is a hardware device that copies the traffic on a link and hands the copy to a monitoring tool, such as an IDS sensor or a SIEM. It gives you visibility into an OT network without opening a path into it.
A TAP isn't a SPAN port. A SPAN port is a switch feature that mirrors traffic to a spare port, needs a managed switch and can drop packets when the switch is busy. A TAP is a separate device that copies the traffic on the link itself. A TAP isn't a data diode either: a diode is for moving data one way out of the control network, a TAP is for copying the traffic on a link.
Every TAP here is made by Garland Technology and is built so traffic cannot flow from the monitoring ports back into the network. Each has been through our IT/OT lab and carries a published price, so you can put it straight onto a bill of materials.
Monitoring only works if the sensor can see the traffic. A TAP is the collection layer: it feeds the sensor a complete copy of the traffic while staying out of the network's way.
A TAP copies the full-duplex traffic on the link itself, so the monitoring tool sees what a busy switch's SPAN port might drop.
Network taps provide passive traffic monitoring without introducing risk, enabling real-time threat detection and forensic analysis.
The monitor ports only send copies out. Nothing a monitoring tool sends can travel back onto the tapped link.
Start with where the traffic comes from. If the switch is unmanaged, or you need the link itself copied, tap the link. If the switch is managed and you are using its SPAN ports, aggregate them so nothing can travel back.
| Compare | Copper breakout TAPGarland P1GCCB | Copper aggregator TAPGarland P1GCCAS | High density aggregator TAPGarland INT1G10CSA | SPAN aggregatorGarland INT1G10CSASP |
|---|---|---|---|---|
| What it does | Copies full-duplex traffic on one copper link in breakout mode. | Copies full-duplex traffic between two devices and aggregates it for one or two monitoring tools. | Taps up to four network segments and aggregates the copies. | Aggregates up to eight SPAN connections onto one or two monitor ports. |
| Traffic source | One 10/100/1000M copper link, tapped inline. | One 10/100/1000M copper link, tapped inline. If power is lost, the link between the two devices stays connected. | Four 10/100/1000M copper links, tapped inline. The links stay live if the TAP loses power. | Up to eight switch SPAN ports, copper. |
| Monitor outputs | Breakout: each direction of traffic is delivered separately. | Aggregation, breakout or regeneration, set by DIP switch. | Two SFP monitor ports. Aggregation, breakout or regeneration. | Two SFP monitor ports. Packets cannot be sent back through them. |
| Best for | Unmanaged switches, where there is no SPAN port to mirror from. | A single critical link feeding a sensor that has one capture port. | Several links feeding one sensor, in a 1U half-rack unit where space is tight. | Several managed switches feeding one SIEM or IDS sensor. |
| Price | $1,075.00 | $1,440.00 | $2,850.00 | $2,844.00 |
| Shop | View product | View product | View product | View product |
Accessories such as DIN mounting hardware are listed on each product page. Garland also makes higher port count 1U appliances, which are quoted on request.
The sensor vendor's install guide asks for a SPAN or TAP feed and leaves the rest to you. These are the parts that fill that line: a breakout TAP for a single link, an aggregator when four links share one sensor port, a SPAN aggregator when the switches are managed. Each has a SKU and a published price for the BOM.
You've bought or been quoted an OT monitoring platform and need traffic for it without adding risk. A TAP gets a copy of the traffic to the sensor with no path back into the control network, which is usually the first thing an operations team asks about.
Portable TAPs go in the kit for sites where a SPAN port can't be configured in time. Tap the link, capture for the length of the visit and take the TAP with you. A 1U rack mount holds four portable TAPs if the engagement turns into a permanent install.
TAPs at Levels 1–2 feed passive visibility to your monitoring stack. Aggregation combines several links or SPAN ports onto one sensor port.
Question not listed? Email info@otcyberdirect.com or call (508) 289-1195.
Network TAPs on this page start at $1,075 for the Copper Breakout TAP. The eight-input SPAN Aggregator, which also blocks return traffic, is $2,844. Every price is published on the product page.
A SPAN port is a switch feature that mirrors traffic to a spare port. It needs a managed switch and can drop packets under load. A TAP is a separate hardware device that sits on the link and copies its full-duplex traffic. On an unmanaged switch, a TAP is the only option.
A TAP copies the traffic on a link to a monitoring tool. A data diode moves data one way out of the control network, for example from SPAN ports to a sensor or from a historian to the business network. If your switches are managed and you want a hardware guarantee nothing comes back, see our data diodes.
The Garland Copper Network TAP and the High Density Aggregator TAP are built so the link between your devices stays connected if the TAP loses power. Installing an inline TAP does mean briefly disconnecting that link, so schedule it with operations.
Yes. The High Density Aggregator TAP combines up to four tapped links, and the SPAN Aggregator combines up to eight SPAN ports, onto one or two monitor ports. Check the combined traffic against the capacity of the monitor port and of the sensor.
The portable TAPs take optional DIN mounting hardware, listed as an accessory on each product page. The High Density Aggregator TAP is a 1U half-rack unit.
Garland ships from its own facility with its own tracking code. Ground shipping is free on most products, and some vendors offer overnight for orders placed before 12 PM ET. These products ship within the US only.
