Introducing Netsplit: a pocket-sized passive Ethernet tap

ethernet, inspection, lan, netsplit, packet, sniff -

Introducing Netsplit: a pocket-sized passive Ethernet tap

Meet the Swiss pocket knife of network traffic inspection

Netsplit is a passive Ethernet tap device, making it easy to sniff packets across Ethernet links. Place the Netsplit between two devices and monitor network traffic on the tap ports.

This works by forcing the devices into 10/100 mode (prohibiting gigabit-speed comms) also known as "Fast Ethernet", which is well suited for passive monitoring. The two ports at the ends of the Netsplit are wired together normally as would a standard cable. However, their respective transmission lines are mirrored to the center "tap" ports.

Because only the transmission lines are mirrored to the center "tap" ports, there is no risk of inadvertently sending out packets which would trip up some IDS or NMS. No need to worry about carefully disabling all transmissions from the "listening" host, as these will simply be filtered out by the Netsplit.

Operating at "Fast Ethernet" (10/100) speeds allows fully passive monitoring, implying no batteries are required. This makes the Netsplit a perfect little gadget to always have handy, ready to whip out at any moment to start sniffing some packets.


Leave a comment

Please note, comments must be approved before they are published