There are Cat 5 network cables in the office going from some rooms to some other rooms through the walls and the ceiling.

The office belonged to another company in the past, which means that there is no guarantee that nobody installed a tracking device in the walls, or that the cable doesn't go to a different office in the building, where it can be tampered with.

Is there anything which can be done using hardware or software on both sides of the cable to ensure that the cable was not tampered with (in other words, that this is indeed a single cable, and not two ones connected through a device such as a switch)? Or the actual, physical inspection is the only way?

To reduce the scope of the question, I'm talking about ordinary tampering by introducing a basic switch which can track what gets through it (and possibly redirect the traffic to another port for inspection, as most switches are able to do). Of course, this excludes military-grade devices which are specifically designed to not only trace the communication, but also resist any attempt to identify them.

  • If you don't trust the cables, then encrypt it. Then you won't have to worry about eavesdropping. If your data is valuable enough that you have legitimate worries that a previous company might have installed a tracking device to snoop on you, then you have legitimate reasons to encrypt the data even if the cables are secure at one point of inspection.
    – Lie Ryan
    Dec 30, 2016 at 1:41

2 Answers 2


I would try to use a cable analyzer for example the DSX-5000 from Fluke. This analyzer should be able to guarantee the continuity of each cable and its characteristics. That should be enough to detect the presence of an unwanted switch or any port mirroring device.

Maybe a simple continuity tester could be enough, but a more professional/expensive cable analyzer could give the cable length, propagation delay, and many other physical elements that could be changed even by a derivation on a line. The hard part would still be to correctly interpret the results, but any strong difference from the standard measures would be a hint that something weird could be there...

  • Agreed. A switch would certainly be detected by even a basic continuity tester. A more advanced tester would probably pick up if anyone had done something more advanced that didn't involve actually cutting cables. Dec 30, 2016 at 1:09

The method that would be employed to solve this would involve comparing the MAC addresses that the network switch ports say are on the other end of each wire, against a list of what those MAC addresses should be. The trick is gathering the list of the MAC addresses, because without actually inventorying the clients and recording their MAC addresses, it would require some discovery automation tooling.

A properly secured network should not allow a device to be plugged in that is not known and authorized to be on the network. Some corporations have this setup and a device that is placed on the network that isn't known to the network will not get an ip address, etc. Some companies have this somewhat worked out such that unknown devices can plug in and connect and get an IP address, but an alert gets sent to the security ops center to investigate. Most companies have nothing in place to prevent or even detect.

If you suspect that the existing cabling might be compromised to begin with then start with the strictest setup to have dhcp deny unknown clients, and perform a discovery of the clients and make them known in dhcp. GHow you do that specifically would vary based on what you use as a DHCP server.

It would also be a good idea to have an intrusion detection system (IDS) that is configured to detect and alert on services running on your network that shouldn't be. For example, a rogue DHCP server, DNS server, access point, etc. How you do this specifically would depend on what IDS platform you select. Snort is mature and stable and full featured and cost-effective:

SNORT Intrusion Detection

It would be best to have an IDS in place even if you don't suspect your network is compromised, and even if you have a good inventory of clients and MAC addresses and only those are allowed. The reason is any of the clients could become compromised and malicious services installed. The MAC address of the compromised client won't change but now that client has become a rogue device.

  • 3
    It would be quite trivial to install an eavesdropping device that did not appear as a device with a separate MAC address - a switch with port mirroring enabled, for example. Dec 29, 2016 at 23:32
  • MAC spoofing is certainly possible, but the majority of attacks wouldn't raise to that level. Nonetheless, this is another reason why I also recommend an IDS solution. If one successfully deploys an eavesdropping device in a manner that flies below network security in place, it still needs to have a way to send the data it collects somewhere that it can be retrieved. Between firewall and IDS such activity would be visible. Dec 30, 2016 at 13:40
  • the majority of attackers are not going to resort to hiding things within walls in the hope of catching out a future tenant. GSM will also work rather well for exfiltrating data. Dec 30, 2016 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .