Tap technology selection

1. A network tap system comprising:

a translator engine to translate a tap request into a set of tap arguments based on a first mapping of keywords to primitives, the set of tap arguments to include a network element primitive;

a selector engine to:

identify selection criteria based on the set of tap arguments and a second mapping of arguments to selection criteria; and

select a tap technology based on a third mapping of selection criteria to a tap technology, the selection criteria to include a tap domain and a sink class; and

a configurator engine to configure a first network element of a plurality of network elements associated with the tap technology based on the set of tap arguments and a tap technology syntax of the tap technology, the first network element to be within the tap domain.

2. The system of claim 1 , comprising:

a moderator engine to maintain a network tap configuration based on a network event, the network tap configuration to include the tap technology and a device configuration of the tap domain.

3. The system of claim 2 , wherein the selection criteria further includes a tap duration, a tap granularity, a device class, and a device capability and the moderator engine is to:

change the network tap configuration based on the network event, the network tap configuration to change at least one of:

the tap technology from a first tap technology to a second tap technology available from the tap domain when a security threshold is achieved;

the tap domain from a first tap domain to a second tap domain including a second network element of the plurality of network elements when a network traffic location changes;

a user domain from a first set of users to a second set of users when membership of a tap user group argument of the set of tap arguments changes; and

the tap duration from a first duration to a second duration based on a logon-logoff event associated with a user tap argument.

4. The system of claim 1 , wherein the keywords are real-world entities and the translator engine comprises:

a location translator engine to identify the network element located in a tap location based on a location keyword;

a user translator engine to identify the network element associated with a user to tap based on a user keyword;

an application translator engine to identify the network element based on an application keyword; and

a device translator engine to identify the network element based on a device keyword.

5. The system of claim 1 , comprising a gather engine to:

maintain configuration options specified by a network administrator;

maintain a plurality of device capabilities offered by a plurality of network elements of the tap domain; and

generate a list of available tap technologies offered by the plurality of network elements based on the configuration options.

6. A non-transitory computer readable storage medium comprising a set of instructions executable by a hardware processor resource of a network tap system to:

identify selection criteria based on a set of tap arguments derived from a tap request and a first mapping of keywords to switch-port tuples;

select a tap technology based on the selection criteria and a second mapping of selection criteria to tap technology, the selection criteria to include a tap domain, a device class, a sink class, and a device capability;

identify a syntax based on the tap technology and the device class;

using the syntax, configure a network element of the tap domain that has the device capability to perform the tap technology based on the set of tap arguments, the network element capable of satisfying a tap duration and a tap granularity.

7. The medium of claim 6 , wherein the first mapping and second mapping are supplied as part of a knowledge base of network administrator expertise and the set of instructions is executable by the processor resource to:

translate a tap request to the set of tap arguments based on a plurality of maps, the plurality of maps to include location information, user information, application information, and device information.

8. The medium of claim 6 , wherein the set of instructions is executable by the processor resource to:

monitor a network comprising the tap domain; and

at least one of:

adjust a configuration of the network element based on an event of the network; and

redeploy the configuration of the network element on an updated tap domain with an updated network tap configuration.

9. The medium of claim 8 , wherein the set of instructions is executable by the processor resource to:

identify the event from information of a network management source, the network management source to include protocol information and network management information.

10. The medium of claim 8 , wherein the set of instructions is executable by the processor resource to:

adjust the configuration of the network element based on a change in location of monitored traffic; and

redeploy the configuration of the network element of the tap domain to a network element outside the tap domain when the target traffic leaves the tap domain.

11. A method for tap technology selection comprising:

identifying, by a network tap system comprising at least a hardware processing resource, a plurality of network element primitives based on a plurality of tap keywords parsed from a tap request and a first mapping that contains the plurality of tap keywords;

determining, by the network tap system, a set of selection criteria based on the plurality of network element primitives, the set of selection criteria to include a tap domain, a device profile, and a sink class;

selecting, by the network tap system, a tap technology based on a comparison of the set of selection criteria to a tap technology profile; the tap technology profile in a format comparable to the set of selection criteria; and

configuring the tap domain to copy packets based on the set of selection criteria using a syntax of the tap technology.

12. The method of claim 11 , comprising:

determining. by the network tap system, a change in a network tap configuration based on a network event identified from monitored network traffic of the tap domain; and

adjusting, by the network tap system, a device configuration of a network element of the tap domain based on the network event.

13. The method of claim 11 , comprising:

redeploying, by the network tap system, based on a network event, a network tap configuration to at least one of:

a different tap domain; and

a different tap technology.

14. The method of claim 11 , comprising:

gathering, by the network tap system, device information from the tap domain;

selecting, by the network tap system, a network element of the tap domain to configure based on a topology of the tap domain and the set of selection criteria; and

configuring, by the network tap system, a flow entry of a flow table of the network element to copy packet information at a granularity specified by the set of selection criteria.

15. The method of claim 11 , wherein identifying a plurality of network element primitives comprises at least one of:

translating, by the network tap system. a tap location based on a location tap keyword;

translating, by the network tap system, a user based on a user tap keyword;

translating, by the network tap system, a protocol based on a first application tap keyword;

translating, by the network tap system, a transport layer port based on a second application tap keyword; and

translating, by the network tap system, a network element identifier based on a device tap keyword.