I have some questions about the Ethernet wiretapping attack. I have already created a small lab using a cat5e (downgraded to 100mbit), a cat7 and this as a keystone: link. The lab looks like this:

client --.TAPHERE.--> switch ---> modem

So far I managed to tap the downgraded cat5e, it was easy, but…

  1. Why for every pair is required a keystone and a NIC? Why isn't possible to use all the needed pairs on the same keystone and NIC?

  2. How to correctly tap a gigabit Ethernet cable without cutting the brown/ blue pair? I mean, I know I have to use all the pairs. In fact, is what I tried, but if I do that, the client (the victim) loses the connection.

  3. Based on that scenario, is it possible to actively join a network rather than just sniffing? If yes, how? What else do I need to achieve that? If no, why?

  • You could simply buy a tap. I've got this one, current version here.
    – gowenfawr
    Oct 11, 2021 at 12:47
  • @gowenfawr thanks for the suggestion, I'm already aware of it, but my scenario is built on a totally different idea, where I have access just to an unprotected cable
    – hyogy
    Oct 11, 2021 at 15:03

1 Answer 1


Why for every pair is required a keystone and a nic? Why is not possible to use all the needed pairs on the same keystone and nic?

Keystones are just passive connectors. You don't need them, just create the required connections any way you like:

What you need for 10BASE-T and 100BASE-TX is to split transmit/receive directions and connect each to a separate NIC's receiver. You need two NICs because there are two independent signals you need to receive (assuming full-duplex mode - with half duplex you just use a repeater hub and make sure that you're not sending anything).

In theory, you could try to use a managed switch in between the taps and a single NIC, but you'd need to set the switch to a single speed/duplex mode on the tap ports just like you'd need with two NICs. A single, static setting is required since Autonegotiation doesn't work with a one-way link. Each link has to go "up" on the detected carrier alone. However, if you've got a managed switch anyway, you could just as well use its port monitoring/mirroring function.

That mechanical splitting isn't possible for 1000BASE-T and faster at all since these use all pairs in full duplex - both directions simultaneously.

Actually, tapping into a gigabit link electrically is a rather complex endeavour as you'd need to separate the superimposed signals, which is much easier for the involved link partners than on an intermediate point - each partner knows what it's currently sending and can subtract that from the received signal (greatly simplified).

Instead, you'd need to terminate the link in between and tap into the terminated link. The most common method is probably a managed switch with port mirroring set up.

  • I used the keystone because it is the most common used with some explanation on how to use it. Thanks for the explanation, I really appreciate that! So, if I get it right, the easier thing do in case of an unprotected gigabit link ( an unprotected cable ) you want to tap, is to insert a rogue switch, is it? While in the case of a 100BASE-TX and lower is to open the cable, tap the orange and green pairs with 2 keystones, connect these 2 to an hub which is in the end connected to a NIC of a computer?
    – hyogy
    Oct 11, 2021 at 15:22
  • insert a rogue switch - Essentially, yes. For 10/100 Mbit/s you can't use a repeater hub in between the taps and a single NIC because a hub wouldn't link and even if it did it would cause constant collisions. You do need two NICs. You need to set the NICs to a static speed (e.g. 100BASE-TX, full duplex), so they link on the carrier alone, without the usual Autonegotiation (which cannot work).
    – Zac67
    Oct 11, 2021 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .