TAP

What is a TAP?

A TAP (Test Access Point) is a hardware device that is physically inserted into a network link and passes a copy of all traffic in both directions to monitoring equipment, without adding any packets to the network itself. Unlike a SPAN port on a switch, a TAP does not depend on the configuration or load of a network component. That is why the TAP is the preferred method in OT networks for permanently monitoring critical links with an IDS, an NDR sensor or an analysis tool such as Wireshark.

A TAP gives a reliable, complete copy of the traffic for network monitoring and forensic investigation, provided you choose the right type and plan the installation carefully.

🧠 How does a TAP work?

A TAP is placed in the cable between two devices, for example between a PLC and an industrial switch. A classic TAP has four ports:

• Two network ports (A and B) - the existing link runs through the TAP via these ports.
• Two monitor ports - one passes the traffic from A to B, the other the traffic from B to A.

The monitor ports are one-way: the TAP sends data to the monitoring tool but accepts nothing back towards the network. A compromised or misconfigured sensor therefore cannot reach the production network through the TAP. This resembles the principle of a data diode, although a TAP is not certified for that purpose.

Because both directions are presented separately, no traffic is lost to an oversubscribed monitor port on a fully loaded Ethernet link. Frames with a CRC error, which a switch would normally discard, also reach the monitoring tool. That makes a TAP valuable when hunting for packet loss, jitter or poor cabling.

🔄 What types of TAP are there?

Not every TAP is fully passive. The type determines what happens on power loss and how complete the copy is.

With a fibre TAP using a 70/30 split, about 70% of the light continues to the network and 30% goes to the monitor port. Typically this means roughly 2 dB of extra attenuation on the network side and about 6 dB on the monitor side. On long single-mode runs or ageing multimode fibre, you need to check that this fits within the optical budget.

🔍 What is the difference between a TAP and SPAN?

On a busy link, the bandwidth of both directions adds up, which makes SPAN vulnerable. In practice, many organisations combine both: TAPs on the most important links, SPAN where a TAP is too expensive or impractical. A managed switch with SPAN is often already in place, whereas a TAP has to be bought and installed per link.

🏭 Where do you place a TAP in an industrial network?

A TAP belongs on links where a lot of relevant traffic converges. Typical tapping points are:

• Between SCADA and the controllers - here you see Modbus TCP, ProfiNET and OPC UA traffic, including write operations to PLCs.
• On the uplink of a cell or zone - a single TAP on the link to the layer above gives visibility of an entire zone in the Purdue Model, usually at levels 1 to 3.
• At the IT/OT boundary - around the firewall to the DMZ, to see what a conduit actually lets through.
• On redundant networks - with PRP, two independent networks run in parallel; a TAP on both paths shows whether frames arrive on both networks. With HSR, traffic runs in a ring, which makes the tapping point more critical.

The aim is usually a continuous picture for passive monitoring: which devices communicate, which commands are sent and what deviates from the normal baseline. In this way, TAPs also feed the asset inventory and the OT SOC.

🔧 How do you set up TAP monitoring in practice?

1. Identify the critical links - start with the connections between SCADA, controllers and the IT/OT boundary. Use the zone model from your network segmentation.
2. Choose the type per link - fibre passive where possible, copper up to 100 Mbit/s passive, gigabit copper only active with fail-safe.
3. Check the failure mode - with an active copper TAP, relays close the link through immediately on power loss. Manufacturers quote switchover times from a few to tens of milliseconds. If the interruption lasts longer, for example around 300 ms, the devices renegotiate the link and a ProfiNET connection with a short watchdog time may drop. Power active TAPs redundantly for that reason.
4. Plan the installation - insertion requires a brief cable interruption. Do it during a shutdown or maintenance window and test beforehand with the process owner.
5. Connect the sensor to a separate network - route the monitor ports to a dedicated monitoring network or VLAN, never back into the production network. Connect only trusted, managed measurement equipment.
6. Process and retain the data - send alerts and logs, preferably encrypted, to a SIEM, for example via Syslog, and keep packet captures for incident investigation where needed.
7. Secure the TAP physically - anyone with access to a monitor port sees all traffic. Place TAPs in locked cabinets and register them as assets.

In the Netherlands, the Cyberbeveiligingswet, in force since 15 August 2026 and transposing NIS2, requires essential and important entities to detect and report incidents in time. IEC 62443-3-3 calls for continuous monitoring of the control system through system requirement SR 6.2. A TAP network is not a legal requirement, but it is a reliable foundation for meeting those detection requirements. One well-known TAP manufacturer, Profitap, is based on the High Tech Campus in Eindhoven.

🔐 What security risks does a TAP itself bring?

A TAP is meant to improve security without endangering process safety, but it also introduces points of attention:

• Confidentiality - a TAP copies everything, including unencrypted passwords and recipes. Treat monitor ports and stored packet captures as sensitive information.
• Physical access - an unknown TAP in a cabinet can serve an attacker instead. Inventory all TAPs and inspect cabinets periodically.
• Availability - an active TAP is an extra component in the link. Without a fail-safe design and reliable power, it becomes a single point of failure.
• Management interface - some active TAPs and packet brokers have a management port. Put it in a management network and change default passwords.

As part of Defense in Depth, a well-managed TAP infrastructure lets you see attacks without touching the process.

❓ Frequently asked questions

Can a TAP disrupt the OT network?

A passive TAP for fibre or 10/100 Mbit/s copper adds no packets and needs no power, so the risk of disruption is very small. An active copper TAP can cause a brief interruption on power loss if its fail-safe relays switch too slowly. Inserting any TAP requires a brief cable interruption.

Why is a TAP more reliable than a SPAN port?

A TAP copies both directions in hardware and also passes errored frames. A SPAN port can drop packets when the mirrored traffic exceeds the capacity of the monitor port and usually does not pass corrupt frames. For permanent monitoring of critical OT links, a TAP is therefore preferred.

Does a TAP have an IP address?

A passive TAP has no IP address and is invisible on the network. The monitor ports of an active TAP have no network address either, but some active models do have a separate management port. You need to secure that management port like any other network management interface.

What is an aggregation TAP?

An aggregation TAP merges the traffic of both directions onto one monitor port, so a tool with a single network card is enough. The drawback is that the combined traffic can exceed the port capacity, causing the buffer to overflow. With the low load of many OT networks this is rarely a problem, but check it on busy uplinks.

Does a TAP work with PROFINET and industrial Ethernet?

A TAP works at the physical layer and is therefore protocol-independent, so it also suits PROFINET, EtherNet/IP and Modbus TCP. Do watch the latency an active TAP adds and its behaviour on power loss, because real-time protocols with short watchdog times are sensitive to interruptions. Fibre TAPs are therefore often the safest choice on critical links.

How many TAPs does a plant need?

The number of TAPs depends on the network architecture, not on the number of devices. TAPs on the uplinks of each zone, the SCADA links and the IT/OT boundary are often enough, supplemented by SPAN for the rest. A network drawing with zones and conduits is the best starting point.

📌 In summary

A TAP provides a complete, hardware-based copy of network traffic without influencing the communication itself. Fibre and 10/100 copper TAPs are passive; gigabit copper requires an active TAP with fail-safe relays. Together with SPAN, an IDS and a SIEM, the TAP forms the foundation of reliable OT monitoring.

A TAP is the most reliable way to monitor critical OT links permanently and completely, provided you match the type and failure mode to the process.