Most security and network monitoring appliances receive network traffic from a passive optical TAP (Test Access Point) or SPAN (Switch Port Analyzer) port. Both of these mechanisms make copies of live network packets and send them to the appliance for analysis. In the process, there are often a high number of duplicate packets transmitted to the appliance—as high as 50% by some estimates. This is often because a SPAN port is configured to copy ingress and egress data from every switch port, which leads to duplicate packets for every packet that goes into and then out of a network switch.
All ANIC adapters come with a deduplication feature which can discard all duplicate packets in hardware before they ever reach the host application. By utilizing this standard ANIC feature, a tremendous number of wasted CPU cycles can be reclaimed and used for higher value feature processing.
For a complete review of all ANIC adapter features see below.