Phantom™ Virtualization Tap

Complete visibility into physical networks and virtualized networks

Phantom Virtualization Tap

Free 30-Day Trial

CRN Head Turning Product

Network World How Product Interop 2012

Free 30-Day Trial

Extend the Visibility of Your Network Performance and Security Monitoring Tools to Monitoring Inter-VM Traffic

Extend the capabilities of your current tools to monitoring of Inter-VM traffic across all best-of-breed hypervisors in virtual computing environments. Control several Taps—or hundreds, with streamlined, unified management of both physical and virtual Taps from one stable, convenient central platform. Versatile new administration capabilities extend management to xBalancer™, iBypass™ and third-party devices. The Phantom Monitor component installs in the hypervisor for total traffic visibility. Use with virtual or physical Intrusion Detection Systems (IDSs), protocol analyzers, layer-2 and layer-3 probes, and other devices.

Phantom Virtulaization Policies

Today’s networks are virtualizing with explosive speed, raising complex challenges and demanding a new approach to security, management and compliance. Virtualization brings sweeping gains in scalability and efficiency, but also creates the severe threat of intrusion. Lack of visibility into the traffic flow between Virtual Machines (VMs) leaves your network vulnerable and uncontrollable, resulting in potential loss of productivity, customers, and revenue.

Achieve the Same Level of Security and Performance Monitoring Across Physical and Virtual Networks

Like a magnifying glass, the landmark Phantom Virtualization Tap exposes the true scope of your virtualized infrastructure. You see every bit of traffic passing between VMs on hypervisor stacks, as well as between VMs residing on separate blades in the same chassis. It taps traffic between your VMs on a physical server and enables rigorous, Best Practices network management and control.

The Phantom Virtualization Tap integrates directly into the hypervisor kernel, enabling full access to the entire network stack without the performance penalty of running your vSwitch in promiscuous mode. Elimination of promiscuous mode improves virtual machine and physical resources; this relief that translates into improved performance, greater throughput and resource optimization. You avoid the loss of important network-layer errors which may be cleaned off before sharing and thus be invisible to other monitoring resources when those very errors are key to successful troubleshooting of your issue. 

Eliminate the Black Hole and Illuminate Your Network Data

The Phantom Virtualization Tap gives you a complete monitoring perspective. As virtualization expands, many instrumentation layer tools are developed for hypervisors and virtual machines. However when users cannot monitor both the virtual and physical aspects of an environment, you run the risk of a “black hole”—when the speed of virtualization outpaces your ability to control and protect your network. That’s why Net Optics supports total access capabilities and unrestricted monitoring by any tool of choice, whether virtual or physical.

Phantom Forwarding Policies

The Phantom Virtualization Tap:

  • Performs smart filtering of traffic of interest at the collection point.
  • Integrates kernel-level monitoring into the heart of your hypervisor and is virtual-switch agnostic—integrating smoothly with your virtual switching vendor of choice.
  • Enables monitoring and access control in dynamic and distributed virtual environments.
  • Eliminates the need for promiscuous mode v-switches, dedicated probes or counterintuitive shaping and routing.

Cost-Efficiently Meets Your Security and Compliance Needs

The Phantom Virtualization Tap optimizes your investment in the physical tools you already own—postponing or reducing the need to purchase expensive, dedicated new virtual tools. Requiring no changes and creating no single point of failure, this versatile Tap supports all best-of-breed hypervisors in the virtual environment: VMware vSphere ESX/ESXi Server 4.X/5.X; Citrix Xen Server 5.6.X; Redhat KVM 2.6.32; Oracle VM 3.0; Parallels Cloud Server 6.0 and Microsoft Hyper-V 2012. It works not only in ESX environments and with internal VMware vSwitches, but also with Cisco Systems’ Nexus 1000V virtual switch. 

Solve Your Compliance Challenges 

To help you audit accurately and simplify compliance, the Phantom Virtualization Tap lets you nonintrusively monitor all traffic passing between VMs on hypervisor stacks. The Tap aggregates traffic from multiple VMs and performs smart filtering; it mirrors all traffic of interest within a virtual switch and exports raw network data within a virtual host to monitoring tools or Intrusion Detection Systems (IDSs). This enables you to perform the needed analytics for compliance and reporting, management, and problem resolution. By enabling complete visibility into all data flowing on the network, the Phantom Virtualization Tap allows for immeasurably better control of the virtual environment and application performance.

Phantom Edit Policies

Achieve Smooth Director™ Switch Integration

The Phantom Virtualization Tap is built to integrate with, and forward traffic to the Net Optics family of Director switches and Net Optics xBalancer™. Extending your options, this Tap is available in various bundles, as an add-on to existing Net Optics monitoring infrastructure, and as a software-only standalone solution.

Manage with Ease and Agility via the GUI-Based Phantom Manager™ Platform

The Phantom Virtualization Tap is managed by the Phantom Manager, which ties smoothly into our  Phantom Manager for enterprise-wide management of all access devices. Phantom Manager delivers a rich-featured view of your network’s health, enabling you to configure at a click. Choose from among 120 informative graphs, while element management and a versatile dashboard let you collect and visualize traffic statistics from all of your Net Optics devices. If faults do occur, Phantom Manager collects and displays event messages and generates alerts. You gain accurate knowledge of patterns and conditions across the infrastructure, so you can act to resolve problems before they affect your availability, productivity and SLAs. Phantom Manager is ensures that you get the greatest value from your Net Optics investment.

Doing Our Part

We are dedicated to ensuring user safety, and developing products that are increasingly environment friendly. All Net Optics products adhere to UL and CE safety certifications; FCC, VCCI, and C-Tick EMC certifications; and RoHS and WEEE environmental certifications.

Watch the Video:

Phantom Virtualization Taps

System Requirements
VMware vSphere ESX/ESXi Server 4.X/5.X; Microsoft Hyper-V 2012 8.X; Citrix Xen Server 5.6.X; Redhat KVM 2.6.32, Oracle VM 3.0, and Parallels Cloud Server 6.0
Phantom Manager for Phantom Virtualization Taps VM: Management and reporting engine that runs in a VM.
Phantom Monitor: A Phantom Monitor is installed in each hypervisor. The Phantom monitor has two components: a Phantom Monitor Control VM and a Phantom Monitor Module, which is a hypervisor kernel.
Network Connectivity
The Phantom Manager for Phantom Virtualization Taps VM virtual appliance must be accessible via HTTPS to access the application interface.
DNS and NTP services should be available for all components.
TCP 443 and 8443 must be available between the Phantom Manager for Phantom Virtualization Taps and Phantom Monitor Control VMs.
TCP 902 must be available between Phantom Manager for Phantom Virtualization Taps and the Hypervisor hosts.
Disk Storage
10 GB free space (minimum)
Web Browser
Internet Explorer 6 or later, Firefox 2 or later, Safari 4.x or later  
Virtual Appliance System Requirements
Compressed size of Virtual Appliances:
Phantom Manager for Phantom Virtualization Taps VM: Approximately 1.2 GB
Phantom Monitor Control VM:
Approximately 1.3 GB
Uncompressed size of system:
Phantom Manager for Phantom Virtualization Taps VM: 16.0 GB
Phantom Monitor Control VM: 4.0 GB
Memory Size:
Phantom Manager for Phantom Virtualization Taps VM:
256 MB (No more than 2GB)
Phantom Monitor Control VM: 385 MB
(No more than 385 MB)

Passive, Secure, Technology
  • 100 percent visibility of traffic between Virtual Machines (VMs) plus inter-blade visibility
  • Installs in hypervisor kernel for full traffic visibility
  • Enables visibility and control of network traffic in all best-of-breed hypervisors in the virtual environment: VMware vSphere ESX/ESXi Server 4.X/5.X; Citrix Xen Server 5.6.X; Redhat KVM 2.6.32; Oracle VM 3.0; Parallels Cloud Server 6.0; Microsoft Hyper-V 2012
  • Generates Layer 2 and 3 statistics (packet count, utilization, etc.)
  • TapFlow™ multi-layer L2-4 filtering engine
  • Extends monitoring and access into the Inter-VM networking layer
  • Applies existing physical monitoring tools, processes, and procedures to the virtual network
  • No interference with the data stream or VMs
  • No modifications needed in VMs
  • Replicates Inter-VM traffic to virtual and physical monitoring tools of choice
  • Sends mirrored traffic out physical NICs in encapsulated tunnels
  • xFilter™, Phantom HD™ terminates encapsulated tunnels and sends traffic to Net Optics Director Data Monitoring Switch (sold separately)
  • One Phantom Virtualization Tap monitors traffic between VMs (one monitor instance is required to be installed on each physical server)
  • Scalable to support and administer high-density environments
  • Phantom Manager for Phantom Virtualization Taps VM (included software component) manages multiple Phantom Virtualization Taps and network traffic
Ease of Use
  • Follows VMs as they move (vMotion) among physical servers
  • Rich, easy-to-use graphical user interface (GUI)
  • Phantom Manager for Phantom Manager console (included software component) manages multiple Phantom Virtualization Taps and network traffic
  • Compatible with all major manufacturers' monitoring devices, including protocol analyzers, probes, data loss prevention, database activity monitoring, Web application firewall, and intrusion detection and prevention systems



- PT-DC-25 Phantom DC Starter
Phantom Virtualization Tap software and license:
2 Phantom Manager + 25 Monitors perpetual license


- PT-DC-50 Phantom DC Standard
Phantom Virtualization Tap software and license:
5 Phantom Manager + 50 Monitors perpetual license


- PT-DC-100 Phantom DC Extreme
Phantom Virtualization Tap software and license:
Unlimited number of Phantom Manager + 100 Monitors perpetual license


- PT-01-Custom
Phantom Virtualization Tap, 1 Phantom Manager + 1 Monitor, One Year License