passive inline Cat5 tap?

[Darkcirc]

I am looking for intructions or ideas on how to build an inline ethernet tap, I've found way to block Tx using a 47uf cap(here) but not how to tap. Simply putting a hub on the line would work but wheres the fun in that? Plus it would be a limiter in other configs. Anyone know how to build a non-powered 3 port hub? Splitting might be an option but that would increse draw and signal return, and I'm not one for killing ports randomly, or worse blowing up my modem and router. Keep in mind the monitor station can and prolly will have Tx blocked using the method mentioned above since stats will be served on another port. The idea is to use ntop ( Ntop here) as well as ethereal (here) to monitor and sniff my inet connections, additionally I might want to sniff router-> switch traffic. This is all facilitated through a server with 7 eth's and a fibre link so the cabling is all that remains. I'm using this setup @ work to monitor the servers and it works quite nicely, but we use a hub anyway. So share you links or stories or even theories... thanks
dc





edit: added link to 'stealth' eth mod

 

[spidey07]

Normally this kind of monitoring is done by mirroring a vlan or port, also called spanning.

Take a 48 port switch with a couple vlans on it. You could take port 48 and designate it as a monitor port, telling the switch software to copy any frame it sends or receives on vlan 10 or whatever. Can also be setup to mirror just a port.

Hook up your monitor to port 48, and now you're seeing all the traffic moving through a switch port/vlan. works flawlessly unless you overload the monitor port with more traffic than it can send (ie greater than 100 or 1000 Mbs)

 

[Darkcirc]

yeah I also forgot to mention, I'm a poor college student, so I am looking at roughly 10 bucks for this whole setup. THe main barrier is the voltage/pin outs...
dc

 

[spidey07]

slap a hub or switch inline then.

 

[Darkcirc]

Thanks spidy but I covered the use of a hub in the original request, plus, if you remember how packet switching works the switch idea is completely useless. The point is that this should be able to be done simply by splitting 2 wires, the only issue is tricking the card into thinking it is online (n.b. online requires that it *thinks* it can send and recieve data.). I'm not looking to buy a switch that can do port mirroring, for half the price of a 48 port backplane I'll just buy one with a gigabit fibre uplink and use that. And any good switch will allow you to mirror, span or whatever. In fact the one I aquired for use at my old job allowed that and it only had 8 ports standard. Either way the solution I'm looking for involves stripping wires and soldering inline components not buying overpriced hardware oreven any complete hardware.
dc

 

[ScottMac]

An intermediate tap such as you describe will kill the transmission characteristics of the cable. You're essentially setting up a "tuned stub." Since there is no way you could cut, strip & solder without untwisting the individual wires, you're introducing a massive impedence lump as well.....attenuation, skew, and crosstalk are all fubar too.

The more common way of doing something like this would be to use a small proto pcb, mount an RJ45 jack on either side, and connect the two together with whatever components you figure you need to do whatever it is you're going to do. Using an intermediate device doesn't interfere with the transmission medium.

Is this a school project?

If you "tap" into a standing cable plant, you've ruined that cable run. Permenant and forever, no way to recover it (at least for high speed data).

IHMO, you're doing a foolish thing (not that you'd care what anyone thinks).

Good Luck

Scott

 

[Darkcirc]

I don't doubt that it is foolish, and no its not for a school project. Its for personal advancement. I have seen patch panels with cables run withing 10 meters of spec stripped 8 inches from the punchdown (!!!). so while I understand the need for specs I also understand that specs are more stringent then they *need to be to work*. The idea here is to push the edge of spec and create something that might be useful in home settings for geeks that don't care too much about standardization or understand that this is a weak link and should be put on long runs. your pcb idea is something I hadn't thought of, and quite frankly I feel rather retarded for not thinking about it. Is there a way to simply split the voltage? or even only break off a third or quarter? I guess now I'll worry about getting the signal, I'll worry about making the nic think its online later. I have seen such taps on compuware's ecoscope product. Though this was for a T1 csu/dsu type connection. Ignoring the impedence and crosstalk and such what are the reprocussions of doing this sort of thing? I'll Admit right now that the physical signalling characteristics are something I know little about, I know what most of the speak means but not how it all happens, if you get my gist. Thanks
dc

 

[n0cmonkey]

There are "taps" out there on the market, but I forget what they are called and have never seen anything on how they are made. Ill check some docs in a bit and edit my post with the name of the ones I have seen mentioned.

EDIT: According to a document I have, there are two main vendors for taps: rioco (www.rioco.co.uk) and shomiti (www.shiomiti.com). They are supposed to be fairly expensive though. You may be able to find designs for a tap, but the ones this document mentioned sound kind of complicated. If you want a copy of the doc let me know and Ill find it again and post a link (I only have a printed version and it appears to be a .pdf so no link on the actual paper itself )