This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Port Mirror Inline Tap

1

Need a device that acts similar to port mirror / port spanning of a layer 2 switch. One I can carry to the end point unplug the device and use this hardware to give me one input for the cable from the network and two connectors one for the intended device (Telephone system) and the second port to plug in my computer running wireshark. I found one for $ 1200. A little too fancy. Just need to tap in and watch the traffic passing that point.

Thanks, Gary

asked 05 Oct '10, 15:32

GaryC's gravatar image

GaryC
21225
accept rate: 0%


3 Answers:

2

Sounds like you're looking for a full-duplex tap (unless you're on a half duplex network, then you just need a hub)...

Yup - full-duplex taps can be pricey. NetOptics makes some (check out their technical docs - they have some good ones showing what aggregating/non-aggregating taps can do). Also see Critical Networks for taps.

If you are a hardware guru (I can't even crimp cables well so this is outta my league), check out http://hackaday.com/2008/09/14/passive-networking-tap/. For super cheap you can make a non-aggregating tap.

Oh - silly me - there are some taps on eBay too - http://shop.ebay.com/?_from=R40&_trksid=p3907.m570.l1313&_nkw=network+tap&_sacat=See-All-Categories.

answered 05 Oct '10, 15:44

lchappell's gravatar image

lchappell ♦
1.2k2730
accept rate: 8%

That should work. We are breaking the line between the Phone system and the SIP trunk carrier to isolate registration faults as carrier or phone system. In other words who is not working. Thanks! Gary

(06 Oct '10, 13:18) GaryC

2

Take a look at Dual-Comm
Betty DuBois wrote an article about it

answered 05 Oct '10, 21:05

joke's gravatar image

joke
1.3k4934
accept rate: 9%

Yes, these Dual-Comm boxes are great.

(05 Oct '10, 23:15) Jaap ♦

Best thing is that they are USB powered. I carry one of them with me at all times, and can capture client workstations without the hassle of looking for a power socket since its powered through my laptop that is doing the capture. Very convenient.

(06 Oct '10, 06:47) Jasper ♦♦

1

If you are a poor man like myself and are on a low budget but want to do high-tech stuff try out the Netgear GS105E (make sure you look at the E model). $59 at Amazon, 5 Gig interfaces, 4 Gig throughput and while it does not have a traditional Web interface for configuration it does come with a little piece of software that you can carry with you that allows you to set an ip,qos and a bunch of other stuff. But most importantly it will let you span multiple ports. It is the size of a pack of cigarettes and work GREAT! If you can't afford a tap it is a GREAT alternative until you can. It's also great for studying for your wireshark cert :)

answered 06 Oct '10, 06:09

blacknight's gravatar image

blacknight
163
accept rate: 0%

edited 06 Oct '10, 06:37