A Ethernet tap allows you to monitor Ethernet communications going through the tap. The circuit uses no power and that is why its called passive. Can be made by cutting Ethernet cords and/or soldering or crimping. This method will make the maximum Ethernet speed 100Mbps, even if its a gigabit Ethernet. Also you could use 2 Ethernet adapters for reading both send and receive lines.
What you will need
2x Ethernet cords(CAT5,CAT6 or CAT5E)
1 pair of scissors or wire strippers
Optional 2x ceramic capacitors(use in case of power over Ethernet)
4x End caps,wiring nuts or solder
Software: Nirsoft SmartSniff with WinPCap
1 pair of pliers( for crimping end caps, if your going to use wiring nuts or solder this is not needed)
Step 1. finding Receive Pair
In order for this circuit to work you must know which wires are the receive pair and ones that are transmit. Patch cords have one of the following color code below.
If green is closest to pin 1 then receive pair are the orange otherwise it’s green. Also crossover and rollover cords don’t have the same wires connected on both sides. After that you must decide which cable can be use as the monitoring cords. It will use wire 3 and 6
Step 2. Building The Circuit
Connect wire pairs as shown.
Device A and Device B are the connection to monitor. And Monitor A and Monitor B are the cords that are used for monitoring the connection. Monitoring Cords uses Pin 3 and 6. And Device cords use Pin 1, 2, 3 and 6. Also make sure to use Promiscuous Mode in SmartSniff. If your device uses Power Over Ethernet, just connect one ceramic capacitor on the blue pair and one on the brown pair. Make sure the capacitors are only on the Device side of the cord and not the monitoring.
Step 3. Testing The Ethernet Tap
You will need 2 computers and one Ethernet Router to test this cord. Plug one Device cord up to a router and the other device end to a computer. Hook one of the monitoring cords up to a different computer. Open SmartSniff and select the Ethernet Adapter with the cord connected to it and select WinPCap and Promiscuous Mode. Next on the computer we are spying on ping the router and see if it shows up in SmartSniff(Its protocol will be under ICMP).
Here’s pictures of my Ethernet tap:
Circuit Simulator