Document Number: OSUP1058
Product: Observer, Expert and Suite
Date:08/14/2006
Title: Using Connection Teaming to Receive Dual-send Output from a TAP

Keywords: Connection Teaming, Dual-Port, Dual-Send, Dual-Receive

Summary
Sometimes it is desirable to use two standard full-duplex NICs to capture TAP output for analysis. Because a standard NIC port has only one receive channel, you must aggregate the receive channels from two ports to “see” both sides of the two-way connection being monitored. Intel’s Advanced Network Services allows you to team multiple connections at the driver level, presenting Observer with an aggregated view of send and receive channels.

Because of the processing overhead and its affect on NIC performance, this method is not recommended for monitoring highly saturated links, such as those between switches. However, it can be an economical alternative when monitoring more lightly used connections, such as between a server and switch. In addition to the bandwidth limitations, connection teaming is also less accurate when timestamping packets, which can cause unexpected results when Observer attempts to display certain charts and statistics such as Connection Dynamics or VoIP jitter. You also will not be able to tell which side is DTE vs. DTE. In short, if you do not have a dual-receive analysis NIC (such as Network Instruments' Gen2 card), it is always better to analyze the SPAN, or port mirror, session through a standard NIC rather than using the connection teaming method described here.

Requirements
You need at least one IntelPro/1000 card that supports Advanced Network Services. If the card has two ports, they can be teamed, otherwise another NIC with an unused port must be present.

Cabling the TAP and Analyzer
As the diagram below shows, the TAP is cabled between the devices being monitored normally (i.e., it provides a pass-through circuit for the link under test). Instead of connecting to a single dual-receive port (as is the preferred deployment), connect the send lines to the transmit (TX) sides of the two ports you intend to aggregate. The diagram shows an IntelPro/1000 Dual-port card, but you can team ports on separate cards as long as one of them is an IntelPro card.

Configuring the IntelPro/1000 Driver Software to Define Teamed Connections

1. Close Observer if it is running, then open Network Connections by right clicking My Network Places on the Windows Start menu and choosing Properties.
2. Right-click a Monitor Port from an IntelPro/1000 card (which one doesn’t matter) and choose Properties. Click the Teaming tab to display the following
   
   
   
   
   
3. Click the “Team with other adapters” option and then click New Team... to start the New Team Wizard. The first dialog lets you name the Team (you may want to call it something like “Virtual Dual-receive”). Click Next> to display the second dialog, which lets you select the adapter/ports to add to the team. Add another adapter/port that supports teaming (for example the second port on a dual-port IntelPro card). Click Next> to display the third dialog, which prompts you to select an aggregation type:
   
   
   
   
   
   
4. Choose Static Link Aggregation. This is the option that works best for aggregating both sides of a full duplex link for analysis. Click Next, and then Finish. The My Network Places display should now list the new virtual adapter.

Using the Virtual Adapter with Observer
When you restart Observer after configuring the virtual adapter, you are automatically prompted to select a new Adapter to use. Choose the virtual adapter by double-clicking it.

You are now ready to run Observer as you usually would.