{
	"id": "f4a8a8eb-bbd5-4847-9869-a3c6ef2f8375",
	"created_at": "2026-04-06T00:15:57.798959Z",
	"updated_at": "2026-04-10T03:21:12.77372Z",
	"deleted_at": null,
	"sha1_hash": "d305367b124e53efeaca7f89dce9a823ccc51d0c",
	"title": "Throwing Star LAN Tap",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 93673,
	"plain_text": "Throwing Star LAN Tap\r\nArchived: 2026-04-05 18:09:55 UTC\r\nNot long after I designed the 5-in-1 Network Admin's Cable several years ago,\r\nI built the first Throwing Star LAN Tap. It is a simple cross of CAT5 cable spliced together to permit in-line\r\nmonitoring of Ethernet connections. As a passive (unpowered) device, it is limited to sniffing 10BASE-T and\r\n100BASE-TX, and each sniffing connector monitors only the network traffic going in one direction. You just\r\ninsert it in-line on a target Ethernet connection (between a computer and a switch, for example), and then you can\r\nuse monitoring tools like tcpdump or Wireshark on a computer attached to one or both of the sniffing connectors.\r\nThe sniffing ports are receive-only, so there is no danger of your monitoring station accidentally transmitting\r\npackets onto the wire.\r\nDespite its limitations, the device has come in handy countless times over the years. It is small enough that I can\r\nkeep it in my backpack all the time. To sniff traffic in both directions, you have to monitor on two ports, but you'd\r\nbe surprised how often sniffing just one direction at a time is sufficient for monitoring and troubleshooting tasks.\r\nIn 2007, Jason MacPherson wrote to me describing his extension of the Throwing Star LAN Tap design. (Alas, the\r\nlink he sent is now broken.) He didn't bother with the throwing star form factor, instead opting to build his device\r\nin a box. The cool thing he did was to use the complete pinout of the 5-in-1 cable (all eight conductors) such that\r\nhis tap could be used for monitoring either Ethernet or RS-232 serial connections. Why didn't I think of that?\r\nEver since then I've thought about building a new throwing star using Jason's\r\napproach. Another improvement I've had in mind is to switch from male RJ-45 plugs to female sockets. Although\r\nthe male version is nifty and tiny, it invariably must be used with two or three couplers. Plus the tabs eventually\r\nbreak off the plugs, which is particularly annoying when they are attached to a very carefully spliced device.\r\nWithin the past year I've learned how to design printed circuit boards, so I decided to try building a female\r\nthrowing star. There was one new problem I had to solve: how to handle 1000BASE-T (Gigabit Ethernet).\r\nBecause 1000BASE-T signals travel in both directions simultaneously on each individual wire, it is impossible to\r\nhttps://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html\r\nPage 1 of 2\n\nbuild a passive tap for the technology. To properly tap 1000BASE-T, you need an active device such as a powered\r\nLAN tap or a switch with a monitor port. In a pinch, though, it is nice to be able to pull something out of your bag\r\nto get the job done, so I opted to make my throwing star compatible with 1000BASE-T in the only way I could, by\r\nbreaking 1000BASE-T:\r\nSince 1000BASE-T uses two more pairs of conductors than 10 or 100 Mbit\r\nEthernet, I bypassed each of those extra pairs with a 220 pF capacitor. (Disregard the erroneous 22 pF marking in\r\nthe photos.) This filters out the high frequency signals of 1000BASE-T, forcing the target devices to revert to\r\n100BASE-TX which can then be monitored. The capacitors don't adversely affect lower frequency RS-232\r\nsignals, so all eight conductors function when monitoring serial connections. Sure, it's an ugly hack, but it's an\r\nugly hack that fits in your pocket.\r\nI figure that most folks who are interested in Bluetooth monitoring have\r\noccasion to sniff Ethernet from time to time, so I'm getting a bunch of kits produced, and I'll drop one into each\r\nreward package sent to backers of Ubertooth One on Kickstarter at the $100 level or higher. I'll also include a bare\r\nPCB with the $15 and $30 reward packages. I'm thinking about handing out PCBs as business cards at hacker\r\ncons, but I can't decide if it is a really good idea or a really bad idea. What do you think?\r\nOpen source design files are here.\r\nUpdate: Throwing Star LAN Tap Kits are now available.\r\nSource: https://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html\r\nhttps://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html"
	],
	"report_names": [
		"throwing-star-lan-tap.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434557,
	"ts_updated_at": 1775791272,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d305367b124e53efeaca7f89dce9a823ccc51d0c.pdf",
		"text": "https://archive.orkl.eu/d305367b124e53efeaca7f89dce9a823ccc51d0c.txt",
		"img": "https://archive.orkl.eu/d305367b124e53efeaca7f89dce9a823ccc51d0c.jpg"
	}
}