[Snort-users] A question about taps
taosecurity at ...11827...
Fri Sep 16 07:37:01 EDT 2005
Gary Brett wrote:
> Just a quick question, I have in my possession a simple little plastic tap
> (basically a little adapter type thing that has 3 RJ48 ports on it, it is
> not a powered device just a little internally wired adapter). After testing
> it, it does exactly what a tap should do and outputs all traffic it receives
> on any of the 3 ports to all the other ports.
I bet I have a device similar to that in front of me now. I bought it
at Radio Shack to see how it worked. I still have the device in the
box because it is worthless for most situations. (I should have
returned it!) It's item 278-785, "Ethernet 10 Base-T Computer Network
Cable Splitter." Radio Shack provides the wiring diagram.  A
search for the part number reveals other people found it to be
Alternative solutions are listed here. 
The problem with these systems is the lack of signal regeneration.
Without power you will have a weaker signal. Over distance you will
I would not use anything like this in production. Even a powered hub
is a better solution than this device. This unpowered splitter is
essentially the same as the do-it-yourself "taps" that are
unfortunately documented elsewhere. 
More information about the Snort-users