Passive Ethernet Tap?

You didn't provide any misinformation phish, it's not so cut and dry. There are many devices out there. When I think of a passive tap it is just that, passive. If it's in line with the network and takes the network down it's not very passive. Not meaning a passive tap is the same as passive monitoring. If the tap requires power it's doing something else or you got taken with a sales pitch or poor design. For instance it may be doing aggregation (combining multiple NIC into a single stream), regeneration (taking a single NIC and regenerating traffic across multiple ports to feed to different devices) or signal conversions at layer 1 (Data Link). Otherwise all ya need is a simple tap with no power and I wouldn't call those above examples passive taps. Since none of them really respond to requests, they all get called passive but in reality they are manipulating things.

Oh and Just because there is a tap present does not mean someone is spying on ya, I use them for bandwidth allocation in a couple of places. The IDS taps are further upstream.

I in particular have no reason to be a suspect of any sort since I have nothing to hide nor anything that I do that violates our Minimum Internat Control Standards. The person that is trying to screw around with the ethernet tap is one of those people that gets the answer the next day because he looks it up on the web and doesn't pull the majority of his knowledge from his brain. From what it looks like, my co-worker and I determined that he is only in the baby stages of trying to figure this out.

If it's the case that he will try to route to an IDF to another patch panel to do this then all we can humanly do is walk the IDF's. And from the way it looks, it is unauthorized because my company is a multibillion dollar a year type place. This place doesn't skimp onkeeping up with technology so having to go out to SNORT.org and pull up schematics for a home made ethernet tap dongle doesn't fit the description of a company that supports it's IT department on tech matters.

Quote:

---

Originally posted here by RoadClosed
Oh and Just because there is a tap present does not mean someone is spying on ya, I use them for bandwidth allocation in a couple of places. The IDS taps are further upstream.

---

Let's put it this way, pacbell setup our routers and pix. We do have people that are cisco certified to configure routers and firewalls, but this person doesn't. So if that's the case, why would he go through the trouble to setup an IDS? Which only brings it back to packet sniffing from what I can conclude.

To go along with that, I am paranoid which is why I am trying to gather information first then make the conclusion :D

lol, or maybe he's just curious.