Ethernet Tap

SNIFFING THROUGH AN ETHERNET TAP:

An Ethernet tap is a virtual driver for network kernels.  Kernels are the central and most crucial component of any operating system for computers.  An Ethernet tap is used for the purpose of implementing devices for networks which basically fully support only software and have no solid hardware to back it up.  An Ethernet tap works almost like an Ethernet device and works on the second layer with the packets like Ethernet frames.  The most basic use of a tap is to create a sort of Network Bridge on the network.

http://affl77.bptinfo.hop.clickbank.net?x=110

Operating systems that send packets through a network tap are basically first delivered to a program of user–space which sticks to the device.  This user–space program is capable of sending packets to the Ethernet tap. There is a program called stack in an operating system to which this Ethernet tap sends packets to.  This is how the process emulates receiving packets from an external source.

MONITORING TRAFFIC ON A SWITCH:

If you are interested in monitoring the traffic being sent on any hub or switch and through an operating system then you can get a passive Ethernet tap for this purpose.  This is most helpful if you are looking for a way to snoop traffic on an Ethernet network.  On the other hand if you are looking for installing an IDS (intrusion detection system) again use a passive Ethernet tap.

For those people who are in to hacking networks, this Ethernet tap is the most famously used device.  At the same time a passive Ethernet tap does not completely fall on the specifications required by an Ethernet device, but it still is enough to work  well.  Surprisingly you can set up a passive Ethernet tap yourself as well low setup fees.  But one problem that occurs is that when we use switches the network gets divided therefore with an Ethernet tap you can only monitor one section and not the entire network.

If you are looking for a solution through which you can monitor both in bound traffic and out bound traffic you should use a separate passive Ethernet tap for both ends. Usually the software for sniffing handles only half – duplex traffic and not full – duplex.  Therefore if you are interested in full – duplex you will need two network cards.

Setting up a passive Ethernet tap is quite easy.  All you have to do is plug in the incoming line of your network in to the host port, and a patch cable to the port that is out going.  Then take the Ethernet port of your sniffing computer and plug into both ends of the passive Ethernet tap. There is software that works along with the passive Ethernet tap and helps put it into promiscuous mode. With this you can now monitor traffic on the entire network rather than just the traffic being directed to the network adapter. If you are not interested in doing it yourself you can ask any professional to help you set up an Ethernet tap so you can monitor your network traffic.