G+_James Landi (Rudedog) Posted July 6, 2017 Share Posted July 6, 2017 Did the Know How team ever do the build your own network tap? Was looking forward to that episode. Link to comment Share on other sites More sharing options...
G+_Travis Hershberger Posted July 6, 2017 Share Posted July 6, 2017 Not that I remember. The I wouldn't trust my memory of things to far ? Link to comment Share on other sites More sharing options...
G+_Hector Sotomayor Posted July 6, 2017 Share Posted July 6, 2017 What is a network tap? Link to comment Share on other sites More sharing options...
G+_Ben Reese Posted July 6, 2017 Share Posted July 6, 2017 I don't think they did a DIY build, but mentioned it could be done. Hector Sotomayor?, a network tap is a device that lets you passively monitor network traffic. Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 6, 2017 Share Posted July 6, 2017 I built one.. Based off the files at hak5.org the throwing star tap. Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 6, 2017 Share Posted July 6, 2017 Here is the insides Link to comment Share on other sites More sharing options...
G+_Ben Reese Posted July 6, 2017 Share Posted July 6, 2017 Black Merc so that requires 2 NICs? Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 Ben Reese unfortunately... yes. Inbound and outbound traffic is separate (some cases a good thing). This is a simple tap.(think FBI tapping your house phone) Link to comment Share on other sites More sharing options...
G+_Golden Retriever Posted July 7, 2017 Share Posted July 7, 2017 They did a whole series on networking 101 ETC....... Link to comment Share on other sites More sharing options...
G+_Ben Reese Posted July 7, 2017 Share Posted July 7, 2017 Black Merc ha. Jokes on them! I don't have a house phone. I just carry around 2 remote spy devices that can track me to a 10ft radius ? Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 Anyway... Having the two separate 'channels' may make it easier to see if that Microsoft product is phoning home. Link to comment Share on other sites More sharing options...
G+_todd zimmerman Posted July 7, 2017 Share Posted July 7, 2017 FYI: Hak5.org has a Throwing Star LAN tap (passive) that you buy and solder yourself for about $15. I had one on order (I received it about a month ago), but saw that Frys had on sale a NetGear ProSafe gigabit switch (GS108E) that had port mirroring that I could get 3 days before the Throwing Star would arrive by mail. I went ahead and got the Switch and have the Throwing Star as a backup. Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 todd zimmerman throwing star don't require power. Link to comment Share on other sites More sharing options...
G+_todd zimmerman Posted July 7, 2017 Share Posted July 7, 2017 Black Merc yes, the throwing star doesn't require power, but its effectively half-duplex, and also limited to 100mbps (it uses a small capacitor on the line to trick the gigabit handshake into thinking there's slight noise on the line to drop the handshake to 100mbps throughput with a supposed low packet loss) Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 todd zimmerman? what more do you need? Unless you have corporate lan (1gig or more) 100 is plenty fast to keep up with the isp connection. Half duplex? How do you figure? Just for the reason you see outbound on one connection and inbound on the other? Remember this is just for you to listen in, Not injections. Link to comment Share on other sites More sharing options...
G+_todd zimmerman Posted July 7, 2017 Share Posted July 7, 2017 Black Merc? I might be wrong on this, but my understanding is that throwing star (under most circumstances) allows you to tap the inbound or the outbound direction, but not both at the same time (not unless you have two Ethernet ports on the eavesdropper). This makes it hard to hear both ends of the conversation (e.g., the outgoing request, and the incoming response) without having to somehow manually multiplex the the sides of the streams together on the packet capture. This is the main reason I opted to use the port mirroring switch option (I can see both incoming and out going packets at the same time, and in relative sequence of each other). The one downside to the mirroring: my "spy" laptop throws its (normal background) traffic out onto the mirrored port that it's listening to for the "victim's" traffic. This requires me to filter out the "spy" traffic from the "victim" traffic in wireshark. Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 todd zimmerman yes to do full capture (in and out bound)with the star will require two nic's, however padre' alluded to a way around, bridging the two nic's together so to listen to both. But, to be sure not to be noticed on your mirror, set the nic to promiscuous mode(listen only), you will hear all and they will hear not. Link to comment Share on other sites More sharing options...
G+_Black Merc Posted July 7, 2017 Share Posted July 7, 2017 todd zimmerman?? sorry i got that wrong promiscuous mode is receive all packets(normal mode receives only packets to your ip address) Here again is the beauty of the old-school tap... The pair your listening to only goes to the receive of that nic (ol'ma bell can listen all she wants as long as she don't wire-in the microphone) Link to comment Share on other sites More sharing options...
G+_Francis Kindred Posted July 13, 2017 Share Posted July 13, 2017 I think padre mentioned he was going to do it after he gets back. Link to comment Share on other sites More sharing options...
Recommended Posts