Network Tap
Definition
A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more monitoring ports. Because it operates at the physical layer, it captures all traffic including error frames and does not drop packets under load. Requires a physical break in the cable to install.
- Layer
- Operates at the physical layer
- Method
- Passively copies the signal to a monitoring port
- Packet loss
- None, even under high traffic load
- Installation
- Requires a physical break in the cable
- Captures
- All traffic, including malformed or error frames
Common questions
How does a network tap differ from mirroring traffic on a switch (SPAN port)?+
A SPAN port copies traffic in software on the switch and can drop frames when the switch is oversubscribed or busy, and it typically discards frames with physical-layer errors. A tap copies the raw signal in hardware, so it captures everything without contending for the switch's processing capacity.
Why do investigators prefer taps for evidentiary packet capture?+
Because a tap is passive and cannot be reconfigured or have its logs altered by an attacker who has compromised the switch, its output is considered more defensible as an unaltered record of what actually passed on the wire.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...
- JA3 / JA3S
- An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- PCAP / PCAPng
- The standard file formats for storing captured packets. PCAP (libpcap format) is the legacy standard supported by virtually all tools. PCAPng (Next...
- PCAPng
- PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and...
- Ring Buffer Capture
- A capture mode in which the tool writes successive PCAP files of a fixed size or duration, overwriting the oldest when the...
- SPAN Port (Port Mirroring)
- A switch feature that copies frames from one or more source ports or VLANs to a designated destination port, where a capture...
Explained in these topics
- Live Packet Capture, Traffic Analysis and Deep Packet InspectionA passive hardware device inserted into a cable run that mirrors traffic to a monitoring port. A tap cannot drop or alter packets; an inline tap (also called a...
- Packet Capture Tools and Methods