Passive Ethernet Tap

A Ethernet tap allows you to monitor Ethernet communications going through the tap. The circuit uses no power and that is why its called passive. Can be made by cutting Ethernet cords and/or soldering or crimping. This method will make the maximum Ethernet speed 100Mbps, even if its a gigabit Ethernet. Also you could use 2 Ethernet adapters for reading both send and receive lines.

What you will need

2x Ethernet cords(CAT5,CAT6 or CAT5E)

1 pair of scissors or wire strippers

Optional 2x ceramic capacitors(use in case of power over Ethernet)

4x End caps,wiring nuts or solder

Software: Nirsoft SmartSniff with WinPCap

1 pair of pliers( for crimping end caps, if your going to use wiring nuts or solder this is not needed)

Step 1. finding Receive Pair

In order for this circuit to work you must know which wires are the receive pair and ones that are transmit. Patch cords have one of the following color code below.

Pins view
Pinout of the RJ45 Patch cord

If green is closest to pin 1 then receive pair are the orange otherwise it’s green. Also crossover and rollover cords don’t have the same wires connected on both sides. After that you must decide which cable can be use as the monitoring cords. It will use wire 3 and 6

Step 2. Building The Circuit

Connect wire pairs as shown.

Cable wiring

Device A and Device B are the connection to monitor. And Monitor A and Monitor B are the cords that are used for monitoring the connection. Monitoring Cords uses Pin 3 and 6. And Device cords use Pin 1, 2, 3 and 6. Also make sure to use Promiscuous Mode in SmartSniff. If your device uses Power Over Ethernet, just connect one ceramic capacitor on the blue pair and one on the brown pair. Make sure the capacitors are only on the Device side of the cord and not the monitoring.

Step 3. Testing The Ethernet Tap

You will need 2 computers and one Ethernet Router to test this cord. Plug one Device cord up to a router and the other device end to a computer. Hook one of the monitoring cords up to a different computer. Open SmartSniff and select the Ethernet Adapter with the cord connected to it and select WinPCap and Promiscuous Mode. Next on the computer we are spying on ping the router and see if it shows up in SmartSniff(Its protocol will be under ICMP).

Here’s pictures of my Ethernet tap:

Published by Justin Roeder

I am an electronics engineer and computer programmer that has autism. I learned by myself

Join the Conversation

2 Comments

  1. Hi! I know this is somewhat off topic but I was wondering if you knew where I could locate a captcha plugin for my comment form? I’m using the same blog platform as yours and I’m having trouble finding one? Thanks a lot!

Leave a comment

Your email address will not be published. Required fields are marked *