This blog article draws on insights from Sake Blok's presentation: "Gotta catch 'em all! A field test of portable gigabit TAPs" at Sharkfest 2024. You can watch the presentation here. Consider becoming a Wireshark member to support the Foundation.
Introduction
Portable gigabit TAPs are essential tools for network professionals, as they enable complete capture of network traffic without impacting the observed device. ProfiShark is one such tool, and Sake Blok's presentation provides valuable insights into its performance compared to other products in the market.
Test Methodology
Sake Blok tested five different portable gigabit TAPs across various parameters, including network port functions, handling of faulty and special packets, throughput performance, and packet ordering. He created various test scenarios using various devices, such as a Cisco PoE switch, a PoE powered phone, an FMADIO capture box, and a Ubuntu laptop.
Technical Features
The following table provides an overview of ProfiShark's technical features compared to other tested TAPs:
|
Feature |
ProfiShark 1G |
DUALCOMM |
NEOX |
LANProbe |
SharkTapUSB |
|
PoE Pass-through |
✅ |
✅ |
✅ |
✅ |
✅ |
|
Link Negotiation |
✅ |
❌ |
Configurable |
✅ |
Model dependent |
|
Link Failure |
✅ |
❌ |
✅ |
✅ |
Model dependent |
|
Power Failure |
✅ |
❌ |
✅ |
✅ |
Model dependent |
|
Small Frame |
✅ |
❌ |
✅ |
✅ |
✅ |
|
Jumbo Frame |
✅ |
❌ |
✅ |
✅ |
✅ |
|
FCS Error |
✅ |
❌ |
✅ |
✅ |
✅ |
|
Special Bridging |
✅ |
❌ |
Behavior dependent |
✅ |
✅ |
|
Aggregation |
100% |
30% |
100% |
>99% |
>99% |
|
Hardware timestamping |
✅ 8ns resolution |
❌ |
❌ |
❌ |
❌ |
|
Inline and |
✅ |
❌ |
✅ |
❌ |
❌ |
|
Driver Support |
Windows, Linux, macOS |
Model dependent |
No Drivers needed |
Model dependent |
Model dependent |
|
Price |
On request |
Low |
Medium |
Low |
Low |
Key Findings
- Transparency: ProfiShark proved to be one of the two most transparent TAPs among those tested, passing all frames, including faulty and special packets, to both network and monitoring ports.
- Performance: ProfiShark demonstrated excellent performance with no packet loss or reordering, even at maximum gigabit speeds.
- Hardware Timestamp precision: ProfiShark offers 8-nanosecond timestamp precision, which is advantageous for time-critical analysis.
- Driver Support: ProfiShark features Windows, Linux, and macOS driver support with regular updates and a large support community.
ProfiShark is a powerful and versatile portable gigabit TAP ideally suited for network professionals who require complete transparency and accuracy in network traffic capture. Its ability to handle all types of frames, excellent performance, and timestamp accuracy make it a top choice for demanding troubleshooting and analysis tasks. While it comes with a higher cost than some other TAPs, its advanced features and reliability justify the investment for those requiring unmatched performance.
