Building a Passive Ethernet Tap
A guide explains how to build a passive Ethernet tap using a few simple components to monitor network traffic without introducing a point of failure. The device physically splits the transmit and receive pairs from an Ethernet cable, allowing a monitoring tool to sniff the traffic while keeping the original link active.
Background
- A passive Ethernet tap splices into a network cable to copy all traffic flowing through it, letting you monitor packets without the connected devices knowing. Unlike a hub or managed switch, it has no active electronics and can't be detected or blocked.
- This project uses 10/100BASE-TX Ethernet magnetics (transformer modules, often salvaged from scrap) wired inline with an RJ45 breakout board. The tapped signal goes to a laptop running Wireshark or tcpdump.
- Why passive taps are useful: they capture everything (including CRC errors and malformed packets that switches drop), they're invisible to the network, and they work even if the monitored link goes down — a managed switch's port mirroring (SPAN) can fail or alter timing.
- Key context: 10/100 Mbps Ethernet uses two twisted pairs (one transmit, one receive). A passive tap uses inductive coupling to create a second copy without amplifying or reshaping the signal. Gigabit Ethernet uses all four pairs and needs active electronics to tap reliably.