This blog article draws on insights from Sake Blok's presentation:
"Gotta catch 'em all! A field test of portable gigabit TAPs" at Sharkfest 2024. You can watch the presentation here. Consider becoming a Wireshark member to support the Foundation.
Introduction
Portable gigabit TAPs are essential tools for network professionals, as they enable complete capture of network traffic without impacting the observed device. ProfiShark is one such tool, and Sake Blok's presentation provides valuable insights into its performance compared to other products in the market.
Test Methodology
Sake Blok tested five different portable gigabit TAPs across various parameters, including network port functions, handling of faulty and special packets, throughput performance, and packet ordering. He created various test scenarios using a combination of devices such as a Cisco PoE switch, a Yealink phone, an FIO capture box, and a Ubuntu laptop.
Technical Features
The following table provides an overview of ProfiShark's technical features compared to other tested TAPs:
|
Feature |
ProfiShark 1G |
DUALCOMM |
NEOX |
LANProbe |
SharkTapUSB |
|
PoE Pass-through |
Yes |
Yes |
Yes |
Yes |
Yes |
|
Link Negotiation |
Yes |
No |
Configurable |
Yes |
Model dependent |
|
Link Failure |
Yes |
No |
No |
Yes |
Model dependent |
|
Power Failure |
Yes |
No |
Yes |
Yes |
Model dependent |
|
Small Frame |
Yes |
No |
Yes |
Yes |
Yes |
|
Jumbo Frame |
Yes |
No |
Yes |
Yes |
Yes |
|
FCS Error |
Yes |
No |
Yes |
Yes |
Yes |
|
Special Bridging |
Yes |
No |
Behavior dependent |
Yes |
Yes |
|
Aggregation |
100% |
30% |
100% |
>99% |
>99% |
|
Timestamp |
8 nanoseconds |
- |
- |
- |
- |
|
Inline and |
Yes |
No |
No |
No |
No |
|
Driver Support |
Windows, Linux, macOS |
Model dependent |
Model dependent |
Model dependent |
Model dependent |
|
Price |
On request |
Low |
Medium |
Medium |
Medium |
Key Findings
- Transparency: ProfiShark proved to be the most transparent TAP among those tested, passing all frames, including faulty and special packets, to both network and monitoring ports.
- Performance: ProfiShark demonstrated excellent performance with no packet loss or reordering, even at maximum gigabit speeds.
- Timestamp Accuracy: ProfiShark offers 8-nanosecond timestamp accuracy, which is advantageous for time-critical analysis.
- Flexibility: ProfiShark can be used in both inline and SPAN modes, providing additional deployment flexibility.
- Driver Support: ProfiShark features driver support for Windows, Linux, and macOS. With regular updates and a large support community.
ProfiShark is a powerful and versatile portable gigabit TAP ideally suited for network professionals who require complete transparency and accuracy in network traffic capture. Its ability to handle all types of frames, excellent performance, and timestamp accuracy make it a top choice for demanding troubleshooting and analysis tasks. While it comes with a higher cost than some other TAPs, its advanced features and reliability justify the investment for those requiring unmatched performance.
