Passive Network Tap

amrogers3

Gawd
Joined
Nov 7, 2010
Messages
570
Any recommendations for a passive (inline) network TAP to monitor traffic? It is for personal use and learning. Willing to buy used to save money. I have seen a few of these on eBay but not sure what brand/model to purchase. I am running 1G network, was going to insert the TAP inline after the FW to test internal traffic. So probably just need one with four ports. One for ingress traffic, one port for egress, and two for monitoring.
 

Cmustang87

[H]ardness Supreme
Joined
Oct 4, 2007
Messages
4,411

amrogers3

Gawd
Joined
Nov 7, 2010
Messages
570
Thanks for the replies,

Appreciate the links, I saw that instructable but the problem is it degrades the speed to 100 since you can't use all 8 wires.

To answer your questions...I am trying to inspect all internal traffic from switch to firewall. The SPAN option might be better based upon my thoughts below....

Taking a step back here, I assume I won't be able to remotely connect to an inline passive appliance since it won't be addressable. I foresee a problem in that monitoring will probably have to be done manually. Since I would prefer to receive alerts real-time, I might be better off using a 1000 Mb switch with a span port instead.

By the way, I would install SNORT on the device. If I remember correctly, I researched SNORT inline a while back and it was a pain in the ass to setup.

What you guys think?
 

Cmustang87

[H]ardness Supreme
Joined
Oct 4, 2007
Messages
4,411
If you are looking to just tap the interface, you need something that runs in promiscuous mode. The easiest solution would be to configure a SPAN port on your switch for all traffic and connect an endpoint to that SPAN port running Wireshark.

SNORT isn't what you are looking for - SNORT is an IDS/IPS function and beyond what you are trying to do, even though you can probably get the data you want.
 

wolfofone

Gawd
Joined
Aug 15, 2010
Messages
724
hmm what about the lan turtle? not sure if that supports gigabit speeds or if you could run the capture software you want on there though...
 

Biznatch

2[H]4U
Joined
Nov 16, 2009
Messages
2,224
If you just need to inspect the traffic between your switch and firewall, why don't you monitor the firewall traffic logs?.... Simple task to do on something like pfsense.

Unless you don't have access to the firewall, then it sounds like you are doing something illegal under the guise of 'I'm just playing around on my home network'. In that case, it's against forum rules to provide help.
 
Top