Thursday, February 17, 2011

Throwing Star LAN Tap

Not long after I designed the 5-in-1 Network Admin's Cable several years ago, I built the first Throwing Star LAN Tap. It is a simple cross of CAT5 cable spliced together to permit in-line monitoring of Ethernet connections. As a passive (unpowered) device, it is limited to sniffing 10BASE-T and 100BASE-TX, and each sniffing connector monitors only the network traffic going in one direction. You just insert it in-line on a target Ethernet connection (between a computer and a switch, for example), and then you can use monitoring tools like tcpdump or Wireshark on a computer attached to one or both of the sniffing connectors. The sniffing ports are receive-only, so there is no danger of your monitoring station accidentally transmitting packets onto the wire.

Despite its limitations, the device has come in handy countless times over the years. It is small enough that I can keep it in my backpack all the time. To sniff traffic in both directions, you have to monitor on two ports, but you'd be surprised how often sniffing just one direction at a time is sufficient for monitoring and troubleshooting tasks.

In 2007, Jason MacPherson wrote to me describing his extension of the Throwing Star LAN Tap design. (Alas, the link he sent is now broken.) He didn't bother with the throwing star form factor, instead opting to build his device in a box. The cool thing he did was to use the complete pinout of the 5-in-1 cable (all eight conductors) such that his tap could be used for monitoring either Ethernet or RS-232 serial connections. Why didn't I think of that?

Ever since then I've thought about building a new throwing star using Jason's approach. Another improvement I've had in mind is to switch from male RJ-45 plugs to female sockets. Although the male version is nifty and tiny, it invariably must be used with two or three couplers. Plus the tabs eventually break off the plugs, which is particularly annoying when they are attached to a very carefully spliced device.

Within the past year I've learned how to design printed circuit boards, so I decided to try building a female throwing star. There was one new problem I had to solve: how to handle 1000BASE-T (Gigabit Ethernet). Because 1000BASE-T signals travel in both directions simultaneously on each individual wire, it is impossible to build a passive tap for the technology. To properly tap 1000BASE-T, you need an active device such as a powered LAN tap or a switch with a monitor port. In a pinch, though, it is nice to be able to pull something out of your bag to get the job done, so I opted to make my throwing star compatible with 1000BASE-T in the only way I could, by breaking 1000BASE-T:

Since 1000BASE-T uses two more pairs of conductors than 10 or 100 Mbit Ethernet, I bypassed each of those extra pairs with a 220 pF capacitor. (Disregard the erroneous 22 pF marking in the photos.) This filters out the high frequency signals of 1000BASE-T, forcing the target devices to revert to 100BASE-TX which can then be monitored. The capacitors don't adversely affect lower frequency RS-232 signals, so all eight conductors function when monitoring serial connections. Sure, it's an ugly hack, but it's an ugly hack that fits in your pocket.

I figure that most folks who are interested in Bluetooth monitoring have occasion to sniff Ethernet from time to time, so I'm getting a bunch of kits produced, and I'll drop one into each reward package sent to backers of Ubertooth One on Kickstarter at the $100 level or higher. I'll also include a bare PCB with the $15 and $30 reward packages. I'm thinking about handing out PCBs as business cards at hacker cons, but I can't decide if it is a really good idea or a really bad idea. What do you think?

Open source design files are here.

Update: Throwing Star LAN Tap Kits are now available.

44 comments:

Unknown said...

Best business card I have seen in a while. Gets the #awesomesauce tag

tz said...

This is great! (and a reason to keep the second usb LAN device in my fixit kit). Any suggestions on what to use since you would have to do a capture on two devices at the same time - does tcpdump or wireshark work well with it (and how should they be setup)>

Michael Ossmann said...

tz: You can bond two interfaces as suggested in the Wireshark wiki or do what I used to do: capture with two tcpdump processes and combine them later with mergecap.

Mino_Modding said...

If you put a star for the $100 pledge, I'll support you Kickstart! Please, tell me if you do that, I've only 9 days left to submit!

Michael Ossmann said...

It's in there, Rigor. See Update #7 and its comment.

Paul said...

My name is Paul and I am the admin of a site called HackHut. You obviously have a lot of skill, and I just wanted to let you know about HackHut because it seems like a perfect fit for you. We are a hosting service somewhat like wordpress, blogspot, or Instructables accept run by and geared toward the hacker/DIYer. We offer or are working on features that people like you want and can use. I hope you check us out and feel free to contact me there if you have any requests for features or questions about the site.

Mino_Modding said...

Tnx a lot, Michael, now I'm an official backer of Ubertooth One :-)

Gerald Combs said...

@tz & @Michael: The upcoming development release of Wireshark (1.7.0) will support multiple capture interfaces.

Luy said...

bummer I wish I could've contributed to Ubertooth One in time.

And yes those are awesome business cards.

Anonymous said...

The eagle files doesn't open.

Anonymous said...

The eagle files dowsn't open.

Michael Ossmann said...

There are no Eagle files. Eagle isn't open source. I use KiCAD.

Anonymous said...

Handing out PCBs as business cards at hacker cons is a good idea at White Hats but a bad one at Black or Grey Hats.

Anonymous said...

There is a lounge at my school that plays POP music over the PA system. It has been playing the same 40 songs for the past three months and despite people complaining, they will not turn it down or off. The controls are locked in a cabinet under a desk, but an Ethernet cable plugs into a router attached to the shelf next to it. Unplugging it prevents any new songs from playing after the last one.

My question is, is there a discrete dongle that can be attached inline that would redirect the incoming internet radio host to another source, such as a youtube playlist for instance?
The majority of people who use the space prefer Rock N Roll.

Julien B said...

Hello,

I really like your idea.

What about removing the sniffing rj45 ports and replacing them with an ethernet/usb chipset?

Even with an extra usb hub chipset, it could be possible to simply connect one usb cable between the Star and a computer.

The computer will then add two NIC.

I personnaly would love such.

Cheers

Anonymous said...

Throwing Star LAN Tap work for both type of network (100mbps & 1Gbps)?

Anonymous said...

Is Throwing Star LAN Tap work for 100 mbps and 1gbps both connections?

Agen Bola Terpercaya said...

I appreciate you sharing this article.Thanks Again. Really Cool.
Agen bola terpercaya

Agen Bola said...

I just couldnt depart your site prior to suggesting that I incredibly enjoyed the standard information an individual supply for your visitors? Is gonna be back often so that you can inspect new posts
Agen Bola

Balls McGhee said...

Penis

Anonymous said...

Balls?! Is that you?

Ethernet Network Cables said...

Covered all the aspects that matters to us. A proper balanced approach taking into account all these points will certainly ensure everything.

Unknown said...

Good post. I am very fond of hardware and networking related products. With so many products and so many things to learn about these products it is quite amazing. My aim is to become leading networking product dealers in Chennai.

Steffie-Cel said...

Good post!
Nintendo Switch Zubehör

Unknown said...

Very good post... it is useful and informative post. Thank you for the sharing wonderful article.
CCTV Camera Dealers in Chennai
CCTV Camera Installation Chennai

obat kuat cialis 80mg said...

klg obat pembesar penis
forex obat pembesar penis
obat kuat hammer of thor
obat kuat cialis 50mg
obat kuat cialis 80mg
obat kuat cialis 100mg
obat kuat levitra 100mg
obat kuat viagra usa 100mg
obat kuat nangen
procomil spray

RoseMarry said...

informative data Used Nissan Leaf Cars For Sale

Chiến SEOCAM said...

Sper că aveți articole mai bune. salutări

Máy massage chân

Chậu ngâm chân

Bồn ngâm massage chân

Japanese Used Cars said...

Useful and informative

Anonymous said...

iPhone
Lampung
Komponen HP
lampung
Sharp
Kursus
Samsung
Philips
HP

Top News from World said...
This comment has been removed by the author.
Top News from World said...

Most Informative and Useful data : Japanese Used Cars For Sale

AltPartsInc said...

Your post is really better for increase knowledge about.
trumpf eco nozzle

sahabatwin88.blogspot.com said...

PERMAINAN ONLINE TERBESAR DI INDONESIA

Website paling ternama dan paling terpercaya di Asia ^^
Sistem pelayanan 24 Jam Non-Stop bersama dengan CS Berpengalaman respon tercepat :)
Memiliki 9 Jenis game yang sangat digemari oleh seluruh peminat poker / domino

- Adu Q
- Bandar Q
- Bandar Sakong
- Bandar Poker
- Poker
- Domino 99
- Capsa Susun
- Bandar66 / Adu Balak
- Perang Baccarat ( GAME TERBARU )

Permainan Judi online yang menggunakan uang asli dan mendapatkan uang asli ^^
* Minimal Deposit : 20.000
* Minimal Withdraw : 20.000
* Deposit dan Withdraw 24 jam Non stop ( Kecuali Bank offline / gangguan )
* Bonus REFFERAL 15 % Seumur hidup tanpa syarat
* Bonus ROLLINGAN 0.3 % Dibagikan 5 hari 1 kali
* Proses Deposit & Withdraw PALING CEPAT
* Sistem keamanan Terbaru & Terjamin
* Poker Online Terpercaya
* Live chat yang Responsive
* Support lebih banyak bank LOKAL Yaitu : Bca, Bri, Bni, Mandiri, Danamon, Cimb niaga , Permata Bank dan Ocbc Nisp
* Tersedia deposit via pulsa telkomsel dan XL serta OVO juga


Contact Us

Website SahabatQQ
WA 1 : +85515769793
WA 2 : +855972076840
LINE : SAHABATQQ
FACEBOOK : SahabatQQ Reborn
TWITTER : SahabatQQ
YM : cs2_sahabatqq@yahoo.com
Kami Siap Melayani anda 24 jam Nonstop

Daftar SahabatQQ
#sahabatQQ #winsahabatQQ #winsahabat #rajakartu99 #windaftar

CRMJetty said...

Thanks for continually sharing such useful, detailed info!


salesforce customer portal

Shiva K Rao said...

Hi,
Would you like to review my answer on same topic?
Here you go -
https://qr.ae/pNraOC
Thanks

Evelyn Carollin said...

MEJAQQ: AGEN JUDI POKER DOMINOQQ BANDARQ ONLINE TERBESAR DI ASIA
Yang Merupakan Agen Judi Poker DominoQQ BandarQ Online Terbesar di Asia Hadir Untuk Anda Semua Dengan Wintare Permainan Tertinggi dan Bonus Yang Menarik!

Kunjungi Sekarang Juga...
Mejaqq
Bandarq online

Unknown said...

http://144.91.101.159/pasarqq/
http://144.91.101.159/hondaqq/
http://144.91.101.159/tarotqq/
http://interqq.inforeclosure.net/
rajawaliqq
hondaqq
http://144.91.101.159/menangdomino99
http://madu99.inforeclosure.net/

Situs Judi Online Terpercaya said...

NAGAQQ: AGEN BANDARQ BANDARQ ONLINE ADUQ ONLINE DOMINOQQ TERBAIK

Yang Merupakan Agen Bandarq, Domino 99, Dan Bandar Poker Online Terpercaya di asia hadir untuk anda semua dengan permainan permainan menarik dan bonus menarik untuk anda semua

Bonus yang diberikan NagaQQ :
* Bonus rollingan 0.5%,setiap senin di bagikannya
* Bonus Refferal 10% + 10%,seumur hidup
* Bonus Jackpot, yang dapat anda dapatkan dengan mudah
* Minimal Depo 15.000
* Minimal WD 20.000

Memegang Gelar atau title sebagai Agen BandarQ Terbaik di masanya

Games Yang di Hadirkan NagaQQ :
* Poker Online
* BandarQ
* Domino99
* Bandar Poker
* Bandar66
* Sakong
* Capsa Susun
* AduQ
* Perang Bacarrat (New Game)

Tersedia Deposit Via pulsa :
Telkomsel & XL

Info Lebih lanjut Kunjungi :
Website : NagaQQ
Facebook : NagaQQ Official
Kontakk : Info NagaQQ
linktree : Agen Judi Online
WHATSAPP : +855977509035
Line : Cs_nagaQQ
TELEGRAM : +855967014811


BACA JUGA BLOGSPORT KAMI YANG LAIN:
agen bandarq terbaik
Winner NagaQQ
Daftar NagaQQ
Agen Poker Online

CrownQQ Official said...

CrownQQ Agen DominoQQ BandarQ dan Domino99 Online Terbesar

Yuk Buruan ikutan bermain di website CrownQQ
Sekarang CROWNQQ Memiliki Game terbaru Dan Ternama loh...

9 permainan :
=> Poker
=> Bandar Poker
=> Domino99
=> BandarQ
=> AduQ
=> Sakong
=> Capsa Susun
=> Bandar 66
=> Perang Baccarat (NEW GAME)

=> Bonus Refferal 20%
=> Bonus Turn Over 0,5%
=> Minimal Depo 20.000
=> Minimal WD 20.000
=> 100% Member Asli
=> Pelayanan DP & WD 24 jam
=> Livechat Kami 24 Jam Online
=> Bisa Dimainkan Di Hp Android0619679319
=> Di Layani Dengan 5 Bank Terbaik
=> 1 User ID 9 Permainan Menarik

Ayo gabung sekarang juga hanya dengan
mengklick CrownQQ

Link Resmi CrownQQ:
ratuajaib.com
ratuajaib.net

Info Lebih lanjut Kunjungi :
WHATSAPP : +855882357563
Line : CS CROWNQQ
Facebook : CrownQQ Official

TiketQiuQiu said...

TiketQQ

Alexios said...

Thanks a lot, waiting for more info. visit https://gazooba.jp

Unknown said...

Agen Slot Live22 Terpercaya

Deposit Live22 Indonesia

Agen Live22 Deposit Pulsa

Agen Live22 Deposit Ovo

Deposit Live22 via Pulsa Tanpa Potongan

Live22 Deposit Pulsa 10 Ribu

siqing chen said...

I got my already programmed and blanked ATM card to withdraw the maximum of $50,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $100,000. Skylink technologies is giving out the card just to help the poor and needy though it is illegal but it is something nice and  they're not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours today Just send them an email On skylinktechnes@yahoo.com whatsapp: +1(213)785-1553