# Probing/monitoring ethernet traffic? [closed]

I'd like to monitore my home network for suspicious traffic.

The simplest option would be my small switch, which allows to forward each and any traffic to a monitoring port. But that's too easy...

Using a Raspberry Pi would be more fun. Thus:

May I modify an ethernet cable in such a way, that an ethernet device - besides the standard endpoints - can monitor traffic?

My question focusses on the electronics part of the cable.

UPDATE 2014-02-13

Found this source, which provides details regarding hacking TP-cables.

## closed as unclear what you're asking by Joe Hass, Matt Young, Chetan Bhargava, RedGrittyBrick, Leon HellerFeb 13 '14 at 10:54

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

• Hello and welcome to EE. This is a software question and not really EE, BTW. Have you looked at Wireshark? I can't think of a way to "modify" an Ethernet cable that will allow you to monitor packets... – dext0rb Feb 12 '14 at 23:51
• @dext0rb Thx! The software part wouldn't be a problem. I'm in interest of the electronics part of the ethernet network cable/adapter. – user37113 Feb 12 '14 at 23:53
• Use your switches port-mirroring feature. No section of Ethernet cable carries all the traffic (switches isolate port traffic according to connected MAC addresses), so splicing cables won't help. – RedGrittyBrick Feb 13 '14 at 10:10

You can certainly sniff packets directly off of any Ethernet that uses coaxial cable media (e.g., 10base2).

However, any Ethernet that uses unshielded twisted pair (UTP, e.g., 10baseT, 100baseT, etc.) is strictly point-to-point. Physically tapping into the cable would disrupt the signal.

To monitor traffic, you either need to use a switch with a monitor port, such as you have, or a "true hub" — one that really does echo every packet received out every other port (these are rare nowadays).

As Dave Tweed mentions this is not trivial. Most home networks today use a switch and without some extra tricks, you can't snoop the network traffic on them if you can't configure one of the ports for this purpose.

Two thing you can do: - run tcpdump on your RPI to snoop the traffic, this is a standard tool on many Linux distributions; - Google for 'ARP cache flooding', there are tools for that too. These tools flood the switch with so many (non existing) host addresses (MAC) that the switch cannot keep track of them and is forced into broadcast mode.

Note that ARP cache flooding in a corporate environment is a perfect reason for getting you fired, but there is no problem in ARP cache flood your own switch. Performance may drop though, depends on the hardware.

• I'm aware of the fact, that a switch doesn't forward each packet to each connected device - like a hub. Nevertheless, I'm still interested regarding the ethernet cable. – user37113 Feb 13 '14 at 21:31
• Additionally, I certainly don't intend to do ARP spoofing at the network of my employer. I wouldn't even connect any of my own devices. – user37113 Feb 13 '14 at 21:34