Wireshark · Ethereal-users: Re: [Ethereal-users] looking to make passive tap

[Guy Harris <gharris@xxxxxxxxx>]

Robert P. Britton wrote:

> Does anyone have any links or documents describing how to make one of 
> these so that we can pick up on physical link errors?

The "Capture Setup/Ethernet" page on the Ethereal Wiki:

	http://wiki.ethereal.com/CaptureSetup_2fEthernet

has a link to "Construction and Use of a Passive Ethernet Tap" on the 
Snort Web site:

	http://www.snort.org/docs/tap/

I have never constructed a tap, so I can't say how well those 
directions, or the taps constructed using them, work.

Note that, as they say there, the tap won't give you both sides of a 
full-duplex connection on one wire; the "Capture Setup/Ethernet" page 
discusses that in the "Capture using a network tap" section.

Also note that Ethereal doesn't keep statistics on low-level errors - 
packets with errors are probably dropped by the network adapter or by 
the driver, so Ethereal won't see those packets.