Comments on: Passive network tap http://hackaday.com/2008/09/14/passive-networking-tap/ Fresh hacks every day Mon, 23 Nov 2009 04:21:03 +0000 http://wordpress.com/ hourly 1 By: k1200pilot http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-77558 k1200pilot Mon, 08 Jun 2009 01:41:01 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-77558 This configuration as presented is easy to make, and simpler than pulling a old router apart to de-solder the 4-port off the SMT board, 32 pins at once. High art would be to make it small enough that it can be concealed under the removable cube wall or disguised (surge protector). Whoever suggested twisting the wire should realize that the 4 pairs have different twist rates so are you going to recommend a twist rate for each pair while you're giving out advise? This configuration as presented is easy to make, and simpler than pulling a old router apart to de-solder the 4-port off the SMT board, 32 pins at once. High art would be to make it small enough that it can be concealed under the removable cube wall or disguised (surge protector). Whoever suggested twisting the wire should realize that the 4 pairs have different twist rates so are you going to recommend a twist rate for each pair while you’re giving out advise?

]]> By: nodens http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-77267 nodens Thu, 04 Jun 2009 14:25:11 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-77267 @me : yes, absolutely. I saw a "Rump session" about that during SSTIC (french security event) in 2006. @me : yes, absolutely. I saw a “Rump session” about that during SSTIC (french security event) in 2006.

]]> By: kindly http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-68450 kindly Sun, 29 Mar 2009 15:49:12 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-68450 Ah yes, yet another case of the HIP-SNIDE internet disease aka... "I know more than you and I will work my ass off to find holes in your ideas and together we will make you feel like shit, when in reality you had a fairly decent idea for the average non-CS-educated user, which works perfectly for certain applications but wouldn't meet Cisco validation, and you went through lots of trouble to present it to us, but never mind the kind gist of the service and keep fucking the poor guy over to help the world see how much I know". Gotta love hiding behind a computer. Ah yes, yet another case of the HIP-SNIDE internet disease aka…
“I know more than you and I will work my ass off to find holes in your ideas and together we will make you feel like shit, when in reality you had a fairly decent idea for the average non-CS-educated user, which works perfectly for certain applications but wouldn’t meet Cisco validation, and you went through lots of trouble to present it to us, but never mind the kind gist of the service and keep fucking the poor guy over to help the world see how much I know”.

Gotta love hiding behind a computer.

]]> By: Me http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-66839 Me Thu, 19 Mar 2009 05:09:01 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-66839 Anyone ever thing about using something like this with a gumstix and have the gumstix autorun tcpdump? Small battery and a tap could be very dangerous. Anyone ever thing about using something like this with a gumstix and have the gumstix autorun tcpdump? Small battery and a tap could be very dangerous.

]]> By: UtahLuge http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-43903 UtahLuge Mon, 29 Sep 2008 21:58:41 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-43903 @ nubie Your name says it all. (I know older post but I need to add this). If you use that, you will screw something up. Unless you hack the cable from that adapter to your computer you need to do it the -right- way. It would be a lot easier to make the adapter than have to fumble for the right cable for that adapter. Also, there is a reason you need 2 nics to sniff the traffic. Each nic only accepts 2 wires for input (10/100). If you try to put both sides of the conversation back into a single line, you will miss half the conversation. PLEASE, go take a basic networking class at your local community college else you may end up forking out lots of money to fix a network you will break. @ nubie

Your name says it all. (I know older post but I need to add this). If you use that, you will screw something up. Unless you hack the cable from that adapter to your computer you need to do it the -right- way. It would be a lot easier to make the adapter than have to fumble for the right cable for that adapter.

Also, there is a reason you need 2 nics to sniff the traffic. Each nic only accepts 2 wires for input (10/100). If you try to put both sides of the conversation back into a single line, you will miss half the conversation.

PLEASE, go take a basic networking class at your local community college else you may end up forking out lots of money to fix a network you will break.

]]> By: nubie http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-42266 nubie Wed, 17 Sep 2008 16:57:39 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-42266 If you need to sniff rx and tx you can buy another t adapter with a male jack to 2x female and plug it into the one I linked above, just open the shells and pull the pins or snip the wires that you don't need, for $2 it is a reasonable solution. I guess it makes sense the importance he places on the jacks if it is only going to sniff one side of the conversation. If you need to sniff rx and tx you can buy another t adapter with a male jack to 2x female and plug it into the one I linked above, just open the shells and pull the pins or snip the wires that you don’t need, for $2 it is a reasonable solution.

I guess it makes sense the importance he places on the jacks if it is only going to sniff one side of the conversation.

]]> By: nubie http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-42265 nubie Wed, 17 Sep 2008 16:51:18 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-42265 Neat, but an $18 hack when a $1 commercial product is available isn't a good idea. http://www.monoprice.com/products/product.asp?c_id=105&cp_id=10513&cs_id=1051304&p_id=1112&seq=1&format=2 If you have the parts laying around and the urgent need for a splitter then this is OK. If you just are thinking of trying it pick up the $1 version. I have 2 of these BTW, and they are wired identically to the instructable. I find it funny that he places importance on the usage of the jacks, all of the jacks should be identical as far as electrical connection is concerned, no need to make them different colors. Neat, but an $18 hack when a $1 commercial product is available isn’t a good idea.

http://www.monoprice.com/products/product.asp?c_id=105&cp_id=10513&cs_id=1051304&p_id=1112&seq=1&format=2

If you have the parts laying around and the urgent need for a splitter then this is OK.

If you just are thinking of trying it pick up the $1 version.

I have 2 of these BTW, and they are wired identically to the instructable.

I find it funny that he places importance on the usage of the jacks, all of the jacks should be identical as far as electrical connection is concerned, no need to make them different colors.

]]> By: barry99705 http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-42066 barry99705 Tue, 16 Sep 2008 14:17:55 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-42066 "Most network admins would pay good money for 4 working cat5 jacks, (as they’re actually rather expensive) while old 10mbit hubs get tossed away routinely. Posted at 10:22 pm on Sep 14th, 2008 by anon" WTF are you talking about? I can get them for about 75 cents a piece in bulk. “Most network admins would pay good money for 4 working cat5 jacks,
(as they’re actually rather expensive) while old 10mbit hubs get tossed away routinely.

Posted at 10:22 pm on Sep 14th, 2008 by anon”

WTF are you talking about? I can get them for about 75 cents
a piece in bulk.

]]> By: alexfox http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41991 alexfox Mon, 15 Sep 2008 22:48:07 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41991 @dontbelieveyou i've never done it before personally, I've merely heard about it many times after a bit of research, it seems like older non-autosensing hubs had no problem with these kinds of cables. newer hubs require a different cable in order to trick them into thinking there is a link on the port. some newer switches/hubs have options in their configurations to allow disabling of autosense, i believe if you can get around the hub link detection, then you obviously use udp for communication references: http://newdata.box.sk/2001/jan/sniffing-faq.htm#receive-only http://www.sunzidigital.com/samngms/sniffing_cable/ @dontbelieveyou

i’ve never done it before personally, I’ve merely heard about it many times

after a bit of research, it seems like older non-autosensing hubs had no problem with these kinds of cables. newer hubs require a different cable in order to trick them into thinking there is a link on the port. some newer switches/hubs have options in their configurations to allow disabling of autosense, i believe

if you can get around the hub link detection, then you obviously use udp for communication

references:
http://newdata.box.sk/2001/jan/sniffing-faq.htm#receive-only
http://www.sunzidigital.com/samngms/sniffing_cable/

]]> By: rivetgeek http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41982 rivetgeek Mon, 15 Sep 2008 20:25:15 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41982 @dontbelieveyou UDP. Ever hear of it? @dontbelieveyou

UDP. Ever hear of it?

]]> By: cde http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41975 cde Mon, 15 Sep 2008 18:19:50 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41975 This is better then a hub, not only for its size (You can make another one with one jack and two ends of a cable, making it only 3~4 inches long), but also because it does not need a power supply or empty outlet (Or the need to carry around a power splitter [Corollary: I carry a 1 to 3 outlet power splitter because there are more students with laptops then there are outlets at school. 99cents and I have power for my laptop with a dead battery :D]). This is completely passive and can be used by anything with an Ethernet port. This is better then a hub, not only for its size (You can make another one with one jack and two ends of a cable, making it only 3~4 inches long), but also because it does not need a power supply or empty outlet (Or the need to carry around a power splitter [Corollary: I carry a 1 to 3 outlet power splitter because there are more students with laptops then there are outlets at school. 99cents and I have power for my laptop with a dead battery :D]). This is completely passive and can be used by anything with an Ethernet port.

]]> By: Dano http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41940 Dano Mon, 15 Sep 2008 08:20:42 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41940 I keep a 10/100 auto sensing hub (not switch) around just for sniffing. it's in a smallbag with extra ethernet cables for when clients call with network troubles. I might make a tap to throw in my normal tool bag though. Small enough to keep handy that way. I keep a 10/100 auto sensing hub (not switch) around just for sniffing. it’s in a smallbag with extra ethernet cables for when clients call with network troubles. I might make a tap to throw in my normal tool bag though. Small enough to keep handy that way.

]]> By: anon http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41920 anon Mon, 15 Sep 2008 05:23:22 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41920 also, guys, your text input box is a little screwed up on firefox, just FYI also, guys, your text input box is a little screwed up on firefox, just FYI

]]> By: anon http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41919 anon Mon, 15 Sep 2008 05:22:44 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41919 Or you could just pull a 4-port 10mbit ethernet hub out of somebody's dumpster. Most network admins would pay good money for 4 working cat5 jacks, (as they're actually rather expensive) while old 10mbit hubs get tossed away routinely. Or you could just pull a 4-port 10mbit ethernet hub out of
somebody’s dumpster.

Most network admins would pay good money for 4 working cat5 jacks,
(as they’re actually rather expensive) while old 10mbit hubs get tossed away routinely.

]]> By: dontbelieveyou http://hackaday.com/2008/09/14/passive-networking-tap/comment-page-1/#comment-41912 dontbelieveyou Mon, 15 Sep 2008 04:18:14 +0000 http://hackadaycom.wordpress.com/?p=3044#comment-41912 alexfox what the frick are you talking about. How could you ever authenticate yourself on a network if your ethernet can only RX. There's something called "handshaking" you know. If you can only RX the only way you can receive is by sniffing all traffic and looking for some type of magic packet to log. But there can't be some address for that computer that any computer on the network can address like normal. alexfox what the frick are you talking about. How could you ever authenticate yourself on a network if your ethernet can only RX. There’s something called “handshaking” you know. If you can only RX the only way you can receive is by sniffing all traffic and looking for some type of magic packet to log. But there can’t be some address for that computer that any computer on the network can address like normal.

]]>