Top 8 Network TAPs for ExtraHop Deployments

ExtraHop RevealX only sees what its sensors receive. If the feed drops packets or splits flows, detections and transaction records suffer. That makes the access layer in front of each sensor a core part of any RevealX design.

RevealX sensors now run from 1 Gbps to 400 Gbps, and data centre links are climbing at the same pace. SPAN ports cope poorly at these speeds. They drop packets under load and raise no alarm when they do. Hardware TAPs and packet brokers close that gap with complete, lossless copies of traffic.

The eight vendors below are compared on products, port speeds and fit with ExtraHop's capture requirements. Each one supplies TAPs, packet brokers or both for RevealX environments. The buyer criteria and FAQs that follow will help you build a shortlist for your next sensor refresh.

Network TAPs for ExtraHop at a Glance

1. Network Critical

Network Critical builds the access and aggregation layer that feeds RevealX sensors. Its passive optical TAPs copy full-duplex traffic with no power and no added point of failure. They cover 1G to 100G links, with up to 16 TAPs in 1RU.

The SmartNA-PortPlus aggregates those feeds and maps them to sensor capture ports. It scales from 48 to 194 ports across 1G to 100G, with 1.8 Tbps of line-rate throughput. Session-aware load balancing by IP, protocol, port, VLAN or MAC keeps each flow on one sensor interface. ExtraHop's own deployment guidance asks for exactly that.

For 400G cores, the SmartNA-PortPlus HyperCore provides 32 QSFP-DD interfaces and 25.6 Tbps in a single rack unit. That gives you a direct path to ExtraHop's 400 Gbps sensor class.

Drag-n-Vu software handles filters and port maps through drag-and-drop configuration. Its rule optimisation engine saves up to 70% of system rule resources. An open API supports fully automated configuration. Hardware is sold on perpetual licences, so adding sensors does not add a subscription.

Best for: SOC and network teams feeding ExtraHop sensors from mixed 1G to 400G links who want predictable costs.

Proven results:

• Darktrace: The SmartNA-PortPlus API lets the NDR platform control its own filters and port maps without manual changes.
• Bourne Leisure: Network Critical TAPs aggregated eight 1Gbps links into one 10Gbps security tool, cutting tool capex eightfold.
• HSBC: Passive optical TAPs fed performance monitoring probes from the UK to Hong Kong with zero latency.

2. Gigamon

GigaVUE-TA400, GigaVUE-HC3 and GigaSMART

Gigamon holds the largest share of the deep observability market, according to 650 Group. It is also a long-standing ExtraHop partner. ExtraHop lists GigaVUE as an integration that supplies aggregated, filtered packets to RevealX sensors. The two firms also sell a joint hybrid cloud offering through World Wide Technology.

The GigaVUE-TA400 packs 32 QSFP-DD ports into 1RU, each running at 400G, 100G or 40G. Every port can also break out to four 100G links. The GigaVUE-HC3 adds integrated 40G and 100G fibre bypass TAPs alongside GigaSMART processing. GigaSMART deduplication removes copies seen across multiple collection points. Its detection window is configurable from 10 to 500,000 microseconds.

Advanced features on GigaVUE nodes are commonly sold as subscription licences with minimum 12-month terms. Budget holders should model renewals alongside hardware when sizing a large sensor estate. Gigamon suits enterprises that want one visibility vendor across physical, virtual and cloud traffic.

3. Keysight

Vision 400, Vision Edge 400S and Vision X 400G

Keysight sells its Vision packet broker family through a network visibility business built on the Ixia acquisition. ExtraHop lists Keysight brokers as a RevealX integration for packet aggregation and filtering. A joint solution brief describes Keysight copper, fibre, industrial and cloud taps feeding Vision brokers ahead of RevealX.

The Vision 400 is a 1RU broker with 24 SFP56 and 16 QSFP-DD ports, supporting 10G to 400G. It forwards up to 9.2 Tbps at line rate on P4-programmable silicon. A built-in FPGA PacketStack handles deduplication, timestamping and burst protection. For larger estates, the Vision X 400G offers up to 54 multispeed ports in 3RU. Backplane capacity reaches 12.8 Tbps.

The point-and-click web interface removes much of the CLI work found on older brokers. Pricing sits at the premium end of the market. On Vision X, deduplication is licensed per PacketStack module, so confirm which licences your RevealX design needs.

4. Garland Technology

SelectTAP, PacketMAX, XtraTAP and EdgeLens

Garland Technology is a US-based TAP specialist with a published RevealX integration. Its reference design starts with high-density passive SelectTAP chassis on each monitored link. Tapped traffic then flows into a PacketMAX Advanced Aggregator. PacketMAX aggregates, filters, load balances and distributes that traffic to ExtraHop sensors. Garland also publishes a bundle integration guide for ExtraHop deployments.

Garland TAPs cover 10/100M to 400G across single-mode fibre, multi-mode fibre and copper. Options include breakout, aggregation, regeneration, bypass and filter TAPs. The XtraTAP range combines TAP and packet broker functions in one device for smaller sites. EdgeLens adds inline security packet brokering for teams that also run inline tools. Garland's Design-IT service helps you plan TAP placement before purchase.

Garland states on its website that products carry no subscriptions or extra fees after purchase. Its field presence is strongest in North America. EMEA and APAC coverage relies more heavily on distributors.

5. Niagara Networks

Open Visibility Platform, Hybrid Packet Broker and ePacketron 5520

Niagara Networks is a Silicon Valley vendor with a joint ExtraHop solution brief. ExtraHop documentation also lists Niagara among its supported packet broker integrations. The Niagara Open Visibility Platform can host ExtraHop virtual sensors on the broker itself. That cuts the number of separate appliances at remote sites and mid-size installations.

Niagara packet brokers support interfaces from 1G to 400G, depending on platform. Hybrid packet broker and bypass platforms combine inline bypass, TAP functionality and brokering in one carrier-grade system. The ePacketron 5520 appliance adds up to 600 Gbps of Layer 4 to Layer 7 processing. A virtual packet broker extends the same features to private and public cloud.

Niagara designs, develops and manufactures its products in the USA, which suits public sector sourcing rules. Hosting sensors on the broker links their capacity planning, so size both together.

6. Arista Networks

DANZ Monitoring Fabric (DMF)

Arista's DANZ Monitoring Fabric is a software-defined packet broker built on merchant-silicon switches and x86 nodes. A filter layer connects to production TAPs and SPAN ports. A delivery layer then connects to tools such as RevealX sensors. One controller manages every switch in the fabric through CLI, GUI or REST API.

Arista's DANZ tap aggregation platforms support up to 576 ports of 400G in one non-blocking system. DMF Service Nodes add advanced packet functions. DMF Recorder Nodes provide packet capture for historical analysis. The scale-out design suits large, multi-tenant monitoring fabrics shared by NetOps and SecOps. DMF Labs offers an online environment for hands-on evaluation before you buy.

DMF delivers most value where Arista already runs the production network. It depends on Arista or approved merchant-silicon hardware, so mixed-vendor estates face a larger architectural commitment. For passive access, Arista has a joint offering that pairs DMF with Siemon passive TAPs.

7. APCON

IntellaView, 400G EdgeSwitch and HyperEngine

APCON is a packet broker specialist based in Wilsonville, Oregon. Its IntellaView platform runs from 1G to 400G across chassis sizes from 1RU to 9RU. The 400G range includes a 32-port 400G EdgeSwitch and a 16-port 400G blade. Both target AI and high-performance computing networks. APCON launched a 28-port multi-function blade alongside them.

The HyperEngine blade adds application filtering, deduplication, traffic shaping and NetFlow generation. A licensed deep packet inspection add-on classifies thousands of applications and protocols. That lets you steer selected application traffic to specific RevealX sensors or other tools. ThreatGuard, an AI-assisted threat detection application, can run on APCON's IntellaStore IV appliance.

APCON is a smaller private company with a US-centric footprint, and pricing is quote-based through partners. If RevealX is your detection platform, you are buying APCON for traffic delivery. Price the broker hardware separately from any on-box security bundle.

8. Profitap

MOD-TAP, MTP Fibre TAPs and X2-Series

Profitap is a Netherlands-based vendor with a strong European field presence. Its passive fibre TAPs cover 1G to 400G links, need no power and add no point of failure. MOD-TAP combines TAP modules of different speeds in one chassis. MTP fibre TAPs target 40GBASE-SR4, 100GBASE-SR4 and 400GBASE-SR8 links in high-density data centres. Profitap tests every fibre component before and after assembly. MOD-TAP suits estates where 10G access links and 100G cores feed the same sensor cluster.

For aggregation, X2-Series next-generation packet brokers add filtering, load balancing, timestamping and deduplication. XX-Series aggregators pre-aggregate traffic to save ports on the X2 layer. Profitap Supervisor manages both series centrally. Profitap also documents integrations with other NDR platforms, including Vectra.

North American coverage is thinner than Profitap's European base and leans on channel partners. Its IOTA capture appliances suit forensic work. In an ExtraHop design, though, they overlap with RevealX packet forensics.

How to Choose the Right Network TAPs for ExtraHop

Match Your Visibility Layer to Sensor Throughput

ExtraHop sensors come in fixed throughput tiers, from 1 Gbps to 100 Gbps, plus a new 400 Gbps class. Enabling IDS on the same appliance cuts usable throughput on larger models, for example from 100 Gbps to 50 Gbps. Size your TAPs and broker ports to the sensor tier, then leave headroom for growth through 2027.

Keep Every Flow on One Sensor Interface

ExtraHop asks that packets from the same flow arrive on the same interface or network card. Per-packet or round-robin distribution splits sessions across interfaces and works against that guidance. Choose hybrid packet brokers with session-aware load balancing that hashes on IP, port and protocol.

Preserve Full Packet Payloads

RevealX decrypts traffic out of band and reassembles full streams, so it needs complete packets. Disable packet slicing, trimming and payload masking on every port that feeds a sensor. Apply those features only to ports serving storage-heavy tools, such as long-term capture.

Replace SPAN on High-Value Segments

SPAN is fine for low-volume links, but it drops packets under load and never reports the loss. ExtraHop documentation expects a single high-performance ERSPAN target to process 20 to 30 Gbps. Virtual sensor interfaces for RPCAP, ERSPAN and VXLAN top out at 1 Gbps each. Put hardware TAPs on core, east-west and data centre interconnect links first.

Count Sensor Capture Interfaces Early

Sensors have a limited number of capture ports. One ExtraHop user review describes 20 TAPs feeding a sensor with only four capture interfaces. That gap forced a packet broker into the design. Count every TAP output before choosing between direct TAP-to-sensor links and brokered aggregation.

Model Total Cost of Ownership

RevealX 360 is a SaaS platform, so your detection layer is already a recurring cost. A second subscription on the visibility layer compounds that spend over a three-year term. Ask each vendor these questions before you compare quotes:

• Is advanced filtering or load balancing sold by subscription, perpetual licence or per port?
• What does adding a second 100G or 400G sensor cost in hardware and licences?
• Can network administrators change filters, or does each change need a vendor engineer?
• What support response times apply, and from which region?

Frequently Asked Questions

Does ExtraHop RevealX Need Network TAPs?

RevealX does not require TAPs, but TAPs give it the most complete feed. Sensors accept mirrored traffic from SPAN, ERSPAN or TAPs and never sit inline. SPAN drops packets when the switch is busy, and those gaps become detection blind spots. Our guide to network TAPs vs SPAN covers the trade-offs in detail.

Can One Packet Broker Feed Several ExtraHop Sensors?

Yes. A packet broker can load balance flows across several sensors and replicate the same traffic to other tools. Session-aware hashing keeps each conversation on a single sensor. This becomes the standard design once traffic exceeds one sensor's rated throughput.

Do I Need 400G TAPs for ExtraHop?

You need 400G TAPs only where your monitored links run at 400G. ExtraHop now offers a 400 Gbps sensor for data centre cores, GPU clusters and dense east-west traffic. Elsewhere, a broker can load balance a 400G link across several 100 Gbps sensors.

How Much Do Network TAPs for an ExtraHop Deployment Cost?

Cost depends on link count, link speed and licensing model, and most vendors quote per project. Passive fibre TAPs are usually the smallest cost element because they contain no electronics or software. The packet broker is the biggest variable, especially where features carry subscription licences. Price a full three-year term, including planned expansion, before you compare vendors.

Do I Need Physical TAPs if ExtraHop Runs in the Cloud?

For cloud workloads, no; for on-premises links, yes. ExtraHop offers virtual sensors for AWS, Azure and Google Cloud that ingest mirrored cloud traffic. Physical data centre links, colocation cages and campus cores still need hardware TAPs or SPAN.

Build Your ExtraHop Visibility Layer With Network Critical

RevealX detections are only as complete as the packets your sensors receive. The right TAPs and brokers protect that feed as your links move to 100G and 400G.

Network Critical is the practical choice for most ExtraHop deployments. Its network taps and hybrid brokers deliver lossless, session-aware feeds from 1G to 400G. Perpetual licensing supports a modelled 40 to 60 per cent lower three-year TCO than subscription-led incumbents. Drag-n-Vu configuration means a typical deployment completes in under two hours. Standard PCAP output lets the same feed serve RevealX, Wireshark and your SIEM. When you need more ports, expansion units connect to the base chassis without replacing it.

Talk to the Network Critical team to request a free network audit and map your ExtraHop sensor estate.