Receive-only UTP cables and Network Taps

Diego González Gómez
diego (at) dgonzalez net

Date: June, 2003
Text Last Updated: May, 2006

Copyright © 2003-2006 Diego González Gómez. Madrid (Spain).
PDF Version Available

Abstract:

One of the disadvantages of a sniffer is that it may be detected by other hosts. There are a number of methods to avoid detection, one being configuring the sniffer without an IP address. But none of them are as effective as the use of receive-only (sniffing) cables. These cables allow a sniffer to watch network traffic without being detected. Therefore they prove very useful in environments with Intrusion Detection Systems (IDS) or honeypot technologies (such as Honeynets).

Keywords: receive-only, cables, sniffing, network taps, uni-directional cables, span ports, mirror ports.