I saw this cool ethernet tap and thought it would be cool to see how chatty my “smart” TV is. But I didn’t want to pay €39 for it. So I made a clone on mini breadboards.
A passive Ethernet tap is a stupid-simple device. It sits inline between your computer and router, copies the signal onto two extra monitor ports, and physically cannot inject traffic back. No power, no software, no configuration. The monitor ports are receive-only. You can’t accidentally DoS your own network with one of these.
The design
The tap has four RJ45 jacks. J1 and J2 are wired straight through, pin for pin. The computer plugs into J1, the router into J2. The link works exactly like a patch cable because, electrically, it is one.
J3 monitors traffic from the computer toward the router. It taps the computer’s TX pair (pins 1 and 2 on J1) and routes it into the monitor’s RX pair (pins 3 and 6). J4 does the same thing in reverse, tapping the router’s TX pair into its monitor’s RX pair.
The monitor ports can’t transmit. Pins 1 and 2 on J3 and J4 are left floating. A monitoring computer plugged into J3 only gets a signal on its receive pair. It sees the traffic, it can’t touch the line. The tap is invisible to both ends.
Two 220 pF ceramic capacitors bridge the unused pairs on the monitor jacks (C1 on J3 pins 4-5, C2 on J4 pins 7-8). Their only job is to corrupt Gigabit auto-negotiation on the blue and brown pairs, forcing the link to fall back to 100 Mbps. Ethernet at 100 Mbps only uses two of the four pairs, and those are exactly the pairs we’re tapping. If the link negotiated at Gigabit and spread data across all four pairs, we’d be blind.
The build
Four RJ45 breakout boards, two 220 pF ceramic caps, and a mini breadboard. €15 worth of parts.
The original Throwing Star LAN Tap uses a custom PCB. I used RJ45 breakout boards with screw terminals. Each board breaks out all 8 pins plus a shield pin to labeled terminals. Four of them, two capacitors, and a mini breadboard.
The inline path (J1 to J2) is eight wires, straight through, on one half of the breadboard.
The passthrough section. All eight pins wired straight between J1 and J2.
The monitor taps branch off the inline path. For J3, I ran jumpers from J1 pins 1 and 2 to J3 pins 3 and 6. For J4, from J2 pins 3 and 6 to J4 pins 3 and 6. The capacitors sit directly on the monitor jacks, bridging the unused pairs.
Finished tap. Passthrough on the left, monitor jacks on the right.
I was worried the breadboard would introduce enough capacitance to degrade the signal. 100BASE-TX runs at 125 MHz. Breadboard parasitics are usually 2-5 pF between adjacent rows, and the impedance is all wrong. But the inline wires are short (about 4 cm of solid-core Cat5e between terminals), and the signal held up fine. A breadboard is not a PCB, and I wouldn’t run a production network through one, but for a passive tap, it works.
What it captured
The only Ethernet-tappable device I had was the smart TV. My laptop doesn’t have an RJ45 port, and the USB Ethernet adapter I ordered hadn’t arrived yet. So the tap sat between the TV and the router, with my desktop plugged into the monitor ports. 2,769 packets in the first 7.5 minutes at an average of 14 kbps. A smart TV at idle doesn’t move much data. Mostly control traffic and device discovery.
The TV announced itself 877 times in under 5 minutes: SSDP NOTIFY packets to
239.255.255.250, one every few seconds. It also broadcast mDNS over both IPv4
and IPv6 simultaneously, same service, same announcements, two protocols. A
“smart” device on a different subnet (192.168.3.7) sent 34 broadcast frames in a
burst. The router at 192.168.2.254 answered everything with IGMP queries.
Zero CRC errors across all 2,769 frames. The link light stayed solid at 100 Mbps. The breadboard didn’t introduce any detectable noise.
Once the USB Ethernet adapter shows up, I can tap my actual laptop traffic, and see something more interesting than a TV shouting its name into the void.
Parts and cost
Most of the stuff I already had hoarded but the ethernet breakout connectors cost €10 for 7. Kinda expensive per piece at €1.4 but it was on next-day delivery.
¯\_(ツ)_/¯