This article draws on research and commentary originally published by itbrief.co.nz, citing analysis from network visibility vendor Ixia.
The Cloud Visibility Problem
Cloud adoption is no longer optional for most enterprises — but the shift to virtualized infrastructure introduces a visibility gap that many organizations are only beginning to acknowledge. According to an Ixia study on virtualization, only 37% of organizations monitored their virtual environments at the same level as their physical networks. That means the majority of businesses are operating with significantly less insight into what is happening inside their virtual infrastructure than they had in on-premises environments.
Jeff Harris, then VP of Solutions Marketing at Ixia, framed the risk clearly: “Most organisations cannot take that chance, so they need to bridge the visibility gap quickly. Visibility will enable better control, to maintain security no matter where their data goes and, of course, to ensure reliability of their core business applications.”
Why Virtual Environments Are Harder to Monitor
In physical networks, traffic monitoring is relatively straightforward: taps or SPAN ports on physical switches capture traffic and send it to monitoring, analytics, and security tools. In virtualized environments, the challenge is compounded by the volume and nature of internal traffic.
Internal east-west traffic — communication between virtual machines, containers, and services within the same data center — typically accounts for around 80% of total traffic in virtual data centers. Much of this traffic never leaves the host, making it invisible to traditional network monitoring tools positioned at the perimeter.
Virtual network taps address this by sending traffic copies to monitoring and security tools. However, without intelligent filtering, the result can be a flood of data that overwhelms downstream tools. The goal is to identify and extract the most relevant traffic efficiently, not to mirror everything indiscriminately.
Four Key Areas for Deploying Virtual Network Taps Effectively
Ixia identified four areas that organizations should address when deploying virtual taps to ensure meaningful, granular access to critical application traffic across virtualized networks.
1. Horizontal Scalability
Virtual environments grow rapidly — new VMs spin up, user counts increase, and data volumes expand, often without much notice. Virtual network taps must be able to scale horizontally to keep pace with this growth without requiring manual IT intervention each time the environment changes.
Ideally, taps should scale automatically in response to traffic volume increases and new workloads, while having zero impact on the performance of monitored applications. If a monitoring solution becomes a bottleneck, teams will be tempted to disable or bypass it — defeating the purpose entirely.
2. Visibility Across Network Segments (“Securing in the Dark”)
Virtual firewalls are commonly used to segment virtualized networks — isolating workloads, enforcing compliance boundaries, and limiting lateral movement in the event of a breach. This segmentation is valuable for security, but it creates blind spots: traffic flowing between segments may not be visible to monitoring or security tools unless the taps are explicitly designed to operate across segment boundaries.
Virtual taps must be capable of capturing inter-segment traffic to ensure that security policies governing each network segment are actually being enforced. Without this visibility, an attacker moving laterally between segments could go undetected.
3. Container Environment Support
Container adoption has grown substantially alongside virtual machine usage, and containers introduce their own visibility challenges. Container lifecycles are short — containers may exist for seconds or minutes — and inter-container communication often bypasses traditional network monitoring points entirely.
Virtual taps must be able to capture traffic within container environments, especially when an organization uses container-based virtualization to boost application performance or density. Monitoring solutions that cannot see into container networking leave a significant portion of application traffic unobserved.
4. DevOps Elasticity and Continuous Deployment Compatibility
Modern DevOps practices mean that new builds, updated services, and changed configurations are deployed continuously across virtual environments. Individual VMs, containers, and microservices now have shorter lifespans than ever, and the topology of a virtual environment can shift significantly between deployments.
This creates a specific risk: a deployment pipeline should never be able to inadvertently take a virtual tap offline or block the traffic path it is monitoring. Monitoring infrastructure must be resilient to — and aware of — rapid changes in the environment, automatically updating its view of the current state without human intervention.
The Takeaway: Visibility and Cloud Speed Are Not Mutually Exclusive
A common misconception is that achieving deep visibility in cloud and virtual environments requires sacrificing the agility and cost benefits that motivated cloud adoption in the first place. Harris argued against this tradeoff: “With the right architecture they can have both.”
The architecture he described is environment-agnostic — capable of monitoring traffic across VMs, containers, and multi-cloud environments — and elastically scalable, distributing relevant traffic intelligently to analytics, security, and compliance tools rather than flooding them with everything.
For DevOps and platform engineering teams, the practical implication is that monitoring and visibility should be treated as first-class infrastructure concerns, built into the platform from the start rather than bolted on after incidents occur. The four areas above — scalability, cross-segment visibility, container support, and deployment resilience — provide a useful checklist for evaluating whether a virtual tap or network visibility solution is truly fit for a modern, dynamic cloud environment.
Summary Checklist
- Horizontal scale: Can the solution grow automatically without manual intervention or performance impact?
- Cross-segment visibility: Can virtual taps capture traffic flowing between network segments created by virtual firewalls?
- Container support: Does the solution monitor traffic inside container environments, not just VM-to-VM traffic?
- DevOps resilience: Will continuous deployments and infrastructure changes leave monitoring intact and current?