Introduction: Make a Passive Network Tap

Picture of Make a Passive Network Tap

This instructable will show you how to make an inexpensive network tap to monitor your network.

Companies like Network Optics make incredible taps, for all sorts of media, but if you have 10/100 home network then for $18 in parts from home depot you can make a tap and send the output to YAF/snort/tcpdump/wireshark and see if any data is leaking that should not be.

I have been doing Flow Analysis lately instead of using other tools. I like YAF . Then again I work on it...

If you want to see step by step instructions on setting up a flow collection infrastructure look at this wiki page.

Step 1: Parts

Picture of Parts

You will need:
3x Leviton Multi Use Cat 5e Jacks (5G108-W)
- I used 2 white and 1 blue, to let me know which one is the tap.
Leviton 3 port wall plate (#41080-3W)
Handy Box
5 inches of cat 5 cable

Step 2: Tools

Picture of Tools

You will need a wire stripper and a screw driver.

Step 3: Strip Wire

Picture of Strip Wire

Cut 5 inches of cat 5 cable, and pull out the 8 strands of wire.

Step 4: Wire the First Jack

Picture of Wire the First Jack

Separate the strands of wire and wire up the leviton jack. It comes with a little punchdown tool to make this job easy. I followed the color code on the side of the jack, it does not really matter though, as long as you are consistent the whole way through.

Step 5: Wire the Second Jack

Picture of Wire the Second Jack

To wire the second jack, you should put both the jacks in the wall plate.
Use the punchdown tool to put the wires in the jack using the color codes or same pattern as you did on the first jack. Make sure to leave enough wire left over to reach the third jack.

Step 6: Third Jack

Picture of Third Jack

To wire the third jack, drop the third jack in the panel then wire it up just like the 1st and 2nd.

Trim any excess wire.

Step 7: Close It Up

Picture of Close It Up

At this point you can close up the box and you are done.

Test it by hooking up the input in the top jack, snooping interface in the middle, and the destination on the bottom.

You can start up your snooping program and watch the traffic spin by. Make sure to have the snooping interface set to promiscuous mode and not assigned an ip.


bryanbrews (author)2008-09-09

Sorry... stupid question. What exactly can you use this for? I can monitor my network using the network monitor application...

AhamedB2 (author)bryanbrews2017-07-16

Even this article is too old to consider as 'Active' it seems Google still send some traffic for people looking for passive network monitoring solution.

To answer @bryanbrews question, you can monitor part of network data with network monitor application but when it comes to capture EVERY Bit of traffic and most impotently Stealthily device like this tap instrument is must. Even it act like some other 'bridge' equipment, it NEVER sent any data to trace back this device. It is something like wireless / radio scanner, it 'catch' all traffic without 'transmit' single bits if data ....

joe (author)bryanbrews2008-09-10

Hey rancidbry- This would used for looking at all the traffic on your network not just what is being sent to your nic. A way to use it would be say if you had a cheap firewall that did not have logging. Clearly you are dropping packets at the firewall for incoming smb requests, but you do not have a way to see where they are coming from. You could place this between the firewall and cable modem, fire up wireshark and see what was coming in. -Joe

insturctables (author)2009-03-22

Dude, that thing's going to be an EMI magnet . . . not to mention all the NEXT potential. Wouldn't it be better to try to maintain the twists to within 1/2" or better of the IDC blades? If it were me, I would put a hairpin bend in each wire at the tap jack and push the entire bend (both sides of the wire) into the IDC. That would allow both conductors of each set (solid and stripe) to be near one another to allow for twisting. Otherwise a great instructable.

With all the computing equipment it will be connecting with it , I t may not be notices, especially if it is used in a wall socket with a power socket nearby.

cferenz made it! (author)Computothought2015-11-02

look there

The picture shows our prototype ! The unit is in general working on the live link

we only have one issue with the master monitoring output if someone is interesting to work with us to fix this issue call me

Malkaris made it! (author)2015-03-10

thanks for the ible

cferenz (author)2014-07-31

But this is only working with 10/100 Mbit

read this to understand why

We are working on a full passiv solution also for Gbit and 80 % is done we have working sample ! We did our own mix signal silicon chip for this you see the gui between the RJ45 sockets marked A and B
Call me for details

vimal1 (author)2012-02-17

cheaper still use 2 cat5 RJ 45 Cables..
cable 1 is host.
cable 2 is tap.
Cut cable2 in half . use a lighter to burn off some of the plastic insulation on the ends
green wire and the green&white wires on both halves.
Remove some of the grey sleeve on cable 1. burn off the insulation on the green&white, green, orange&white and orange wires.
now connect the green&white wire from cable 2 to the green&white wire on cable 1. insulate with electrical tape.
connect the green wire from cable 2 to the green wire on cable 1
insulate with electrical tape.
connect the green wire from other half of cable 2 to the orange wire on cable 1
insulate with electrical tape
connect the green&white wire from other half of cable 2 to the Orange&white wire on cable 1.
insulate with electrical tape.
use marker pen to identify host , tap A and B
cheap and simple.
remove the cable from your PC and Router and replace with cable 1
plug end of cable 2 into another computer with wireshark etc. running . you now have a passive tap.
image grey cable host.
yellow cable tap.

rrostamnejad (author)2011-08-31


samchen (author)2010-11-23

I don't get it: Make sure to have the snooping interface set to promiscuous mode and not assigned an ip. How can I do this on a windows machine?

When I plug the cable from a NB with wireshark, the connections were cut off on two machines. Could any explain? Thanks.

cowen (author)2010-04-04

Ok try a normal run average of about 100' untwisted.

There are tolerances but not big ones.

c80drew (author)2010-01-29


 Just came across your instructions here, and I put a tap together exactly how you detailed in this instructable. I connect it inline between my modem and router, and I maintain internet access as normal. As soon as I plug the third ethernet cable into the tap interface (or any combination for that matter), my internet connectivity gets interupted and I can no longer pull an IP from my ISP or send/receive traffic. This happens even if the third/tap cable isn't connected to my system setup for passive monitoring - it is just the act of plugging in the cable that causes the interruption. I liked this option because it only required one interface for the passive monitoring (I have a dell laptop I was planning to use), vice the other directions online with 2 interfaces... any advice??


kiel2155 (author)c80drew2010-02-09
Just built this instructable as well and same problem.  I can connect the router and 1 of the computers in either the pass-through or tap port and it works great, no problem.  As soon as the second computer gets plugged in, all lights on the Ethernet ports go out and the connection drops.  Could it be due to not enough voltage/power running through the cable?
primekhan (author)2008-09-17

Without twisting the pairs, what's to guard against NEXT (Near end cross talk)? It seems not have been a problem in your case, but if the desire is to monitor *all* traffic, perhaps it would be worth the time to make certain that the hardware wasn't causing any packet loss. Just a thought. I love your idea though!

nubie (author)2008-09-17

Nice, I am very interested in the software tools that you use, it is much cheaper to buy a commercial connector for a $1 if you don't have network stuff laying around:

The 2 I bought are wired as your custom jack here, I opened mine and moved the pins around for use as normal t-splitters to put 2 100Mb LAN links through a single run of Cat5.

If you purchase these they should be wired identically to your box :)

dings (author)2008-09-12

BridgeCouldn't you just put a box in between with two network cards, set up an ethernet bridge and listen to the traffic on the bridge?
I realy like the idèa by the way. What would be realy nice was just two outlets and a "short circut switch," so that traffic either could go through something connected to both or directly across.

benjamander (author)2008-09-09

How is this better than just plugging the sniffer into your router/network switch? Wouldn't that allow the same thing?

baconfish (author)benjamander2008-09-10

Routers and switches don't work that way. They keep track of which IP is connected to which jack and only forwards the packet on the appropriate connection. Hubs, on the other hand, don't bother and will send everywhere.

Hoagie (author)baconfish2008-09-11

There's a technique called ARP cache poisoning that makes switches send you the data but it's easier to use a hub if you can get one these days.

baconfish (author)Hoagie2008-09-11

True, I just kind of figured that defeated the whole "passive" thing.

Hoagie (author)baconfish2008-09-12

Definitely. Some switches detect it as a security breach too.

joe (author)benjamander2008-09-10

Its not better at all, if your router has the ability to do a span port, or if you a sniffer/tap you don't need this. This would be more aimed at the home user who wanted to see , for example if non routeable traffic was making it past your linksys firewall. Thanks for looking. -Joe

wethecom (author)2008-09-11

this is over my head but...dont laugh to hard for this suggestion... couldn't you use windows xp or something like that and give everyone service threw your machine and use wireshark to monitor the data more than sure i missed a few fine points in this discussion but wouldn't it be the same or at least similar results

redshirt3 (author)2008-09-11

Be careful with hooking in a hub, a switch is full duplex at the speed on each direction. A hub is not. you can lose critical packets. A hub will allow you to insert packets into the stream. This solution is still better if stealth is required.

puffyfluff (author)2008-09-11

Neat Idea, I never would have thought of this.

Zak (author)2008-09-09

This may work a bit but is is not 'correct'. The snooping PC will have its input connected to one direction of communication, while the other direction is not monitored, but even hampered as it is connected to the output of the 'snooping PC'. TO do this right needs 2 network cards in the snooper, of which one RX pair listens to what goes from A to B, while the other listens to what goes in the other direction (over a different wire pair).

Hoagie (author)Zak2008-09-11

That's true - especially the bit about the TX pair hindering the link. Sometimes, just one direction is all you want. In those cases just connecting one pair in the sniffer socket and using one NIC would be fine. Can't remember which pair is which off the top of my head though.

MACKattacksnipe (author)Zak2008-09-10

your exactly right

your exactly right Zak

joe (author)Zak2008-09-10

Hey Zak - You are correct, you can make the tap your are talking about and use two nics. I have had success using this tap with fedora setting the nic to promiscuous and disabling arp and am able to see all traffic. I'll put together another instructable showing the tap you are talking about. Thanks for bringing this up. -Joe

Spokehedz (author)2008-09-11

The much easier solution (and indeed, a much more robust solution) is to find a cheap 10/100 HUB (not a switch) and put it in the middle of whatever you want to monitor. yeah. The ones that are $1 at fleamarkets. Oldest trick in the book.

Marche (author)2008-09-09

Awesome work dude! Ill post pics when I finish building one inside a altoids tin for mobile tapping :3

joe (author)Marche2008-09-10

Thanks! I knew I should have jammed it in a altoids tin :) -Joe

brs928 (author)2008-09-09

I don't think it matters what jack you plug into for the incoming, monitoring, and outgoing cables. They're all just wired in parallel, so it makes no difference.

mrmath (author)2008-09-08

Alright, stupid question time. I know that the pairs are twisted to deal with magnetic stuff. I used to know exactly why, but that was in a geekier lifetime. Wouldn't you be better off leaving the wires as twisted as possible? Doesn't untwisting deteriorate the signal some? Or is the distance you're covering here so small that it won't make a difference? (That last one, by the way, doesn't seem possible, as the wires are pretty tightly wrapped.

tehmiller (author)mrmath2008-09-08

The distance between the jacks here is too insignificant to cause much signal deterioration. For something like this, it doesn't really matter, at least in my experience. But watch someone come along and completely blow my theory out of the water :P

frollard (author)tehmiller2008-09-08

In my network wiring classes, we were instructed when punching keep the wires twisted as long as humanly possible - but reality is that the tolerances are built into the hardware these days that a a millimeter or even an inch untwisted wont hurt you in noise/attenuation...much.

crapflinger (author)tehmiller2008-09-08

at this distance it shouldn't make a difference at could just strip a small portion of the ethernet sheathing on the ends and just double punch the lines (i.e. two of the same color in each punch) but that could get a little funky

About This Instructable




Bio: I like to tinker with just about anything, sometimes it works out in the end. Have fun looking at the projects, try tearing something open ... More »
More by joe:Intel Edison Garage Monitor and Alert SystemIntel Edison Fat Bike Tire AnalyzerIntel Galileo Garage Monitor
Add instructable to: