Influence of a TAP

Question

I want to use a passive TAP to sniff all the network (100 Mbps full duplex twisted pair).

I have two interfaces for sniffing and only one pair for each direction. Will the TAP add any noise? Or if I use a long cable? 100 meter, for example.

Answer 1

It seems unlikely that all the network traffic passes through a single 100 Mbps cable. Remember that with switched ethernet, a switch will send traffic directly from the source to the destination interfaces, not to all the interfaces.

In any case, yes, you can permanently damage a UTP cable by inserting a tap. In fact, that is directly addressed by ANSI/TIA/EIA 568 Commercial Building Telecommunications Cabling Standard:

Only one transition point or consolidation point between the horizontal cross connect and the telecommunications outlet shall be allowed, and bridged taps and splices are not allowed in the copper horizontal.

Doing something like that will create impedance mismatches and echoes that can disrupt the functioning. Modern networking needs a lot more than simple electrical connectivity. There is an entire test suite that must be passed to ensure a functioning cable. The primary tests are:

• Wire Map - Checks for proper pin to pin termination, and for each of the 8 conductors the wire map checks for: Continuity to the far end, Shorts between any two or more conductors, Reversed Pairs, Split Pairs, Transposed Pairs, Any other miswiring.

• Length - The physical length of the cable is the actual length derived by measurement of the cable(s) between the two end points. The electrical length is the length derived from the propagation delay of the signal and depends on the construction of the cable. The maximum physical length of the horizontal cable (permanent link) one end of the cable to the other is 90 meters. The maximum length of the channel model is 100 meters.

• Insertion Loss - Insertion loss is the loss derived from inserting a device into a transmission line. The insertion loss for both the permanent link and the channel models are the total insertion losses of all the components.

• Near End Cross Talk (NEXT) - Pair to pair NEXT loss is the measurement of signal coupling from one pair to another. The result is based on the worst pair to pair measurement.

• Power Sum Near End Cross Talk (PSNEXT) - Power sum NEXT takes into account the statistical crosstalk between all pairs while energized. This is a calculated amount derived by adding up the crosstalk results between all pair combinations.

• Equal Level Far End Cross Talk (ELFEXT) - FEXT is the unwanted coupling of a signal induced by a transmitter at the near end, measured on the disturbed pair at the far end. ELFEXT is the same measurement of FEXT, less the effect of attenuation.

• Power Sum Equal Level Far End Crosstalk (PSELFEXT) - As in Power Sum NEXT, these are computed values based on the sum of all the possible pair combinations under the respective tests.

• Return Loss - Return loss is the value of energy reflected by impedance variations when devices are inserted into the cabling system.

• Propagation Delay - Is the time it takes the signal to travel from one end of the cable/system to the other. The maximum channel propagation delay is 555ns (nanoseconds) and for the link it is 498 ns, both measured at 10 MHz.

• Delay Skew - Delay skew is the signalling delay difference in time (nanoseconds) between the fastest pair and the slowest pair. The maximum channel delay skew is 50 ns, and in the permanent link it is 44 ns.

Any tests that are out of specification will fail the test, and the condition must be corrected and the test suite performed again until the cable passes or is replaced.

The channel length of 100 meters is predicated on up to 90 meters of solid-core horizontal cable, and no more than a total of 10 meters of stranded patch cables (divided between the two ends).

---

The proper way to do what you want is to configure something like SPAN on your switches to mirror traffic to a particular switch interface or VLAN.