[Snort-users] Passive Tap Help

Peters, Michael D. Michael.Peters at ...9763...
Mon Dec 1 07:24:02 EST 2003

http://www.snort.org/docs/100Mb_tapping1.pdf is the picture I am
referencing. I am looking to decipher the exact pin out of the 100Mb copper
tap. It looks like I would have 4 - RJ45 Ethernet jacks in the tap.

I guess I am looking for an "Ethernet Tap for Dummies" version that includes
the wiring pin out for all 4 jacks.

Best regards,

Michael D. Peters 

-----Original Message-----
From: Frank Knobbe [mailto:frank at ...9761...]
Sent: Monday, December 01, 2003 10:06 AM
To: Peters, Michael D.
Cc: Snort-Users at ...1973... Sourceforge. Net (E-mail)
Subject: Re: [Snort-users] Passive Tap Help

On Mon, 2003-12-01 at 07:50, Peters, Michael D. wrote:
> I have been examining the diagram for the passive tap. I don't really
> understand and I was hoping someone would clarify the drawing for me?

I think you are confusing the read-only cables with taps. These cables
are a cheap-mans tap. Real taps work differently. 

> Inside the tap is where I think my understanding has broken down. The
> picture seems to indicate that there is a crossover occurring on the
> <CABLE> which I know would not work.

Work fine for me. Please indicate which cable you are talking about. The
one in the Snort FAQ uses a feedback to fake a link (and hence can only
be used on a hub, not a switch). Other cables munge the Send signal with

Taps are different. They take the Receive line and feed it into
electronics, providing amplification, stabilization and an output driver
stage. In other words, there is electronics behind them, not just some
cable wizardy.


More information about the Snort-users mailing list