I saw a passive Ethernet tap online, a little metal box with four RJ45 jacks, and thought: I want to know how chatty my "smart" doorbell actually is. Then I saw the price — €39 for what is, electrically, a splitter — and closed the tab. Not because I couldn't afford it, but because I resented paying that much to eavesdrop on a device I already own, on a network I already pay for.
That resentment is the whole reason DIY networking hardware exists. The question underneath it — the one you've probably asked yourself at 1 a.m. while watching a router LED blink for no reason — is simple: can I actually see what my devices are saying on the wire without buying gear that costs more than the devices themselves?
The honest answer is yes, mostly, with a couple of real caveats I'll get to. Let me show you the whole thing, including the parts where it depends.
What "packet sniffing" actually means, and where it gets murky
Packet sniffing is capturing the raw frames traveling across a network so you can read them in software like Wireshark. That's the clean definition. The murky part is how you get the packets to your capture machine, and this is where most tutorials wave their hands.
You have roughly three options, and they are not equal:
- A managed switch with port mirroring (SPAN). You tell the switch to copy all traffic from one port to another, then plug your laptop into the copy. Great if you own a managed switch. Most people at home don't, and buying one to spy on one lightbulb feels backwards.
- WiFi monitor mode. For wireless traffic, you put a supported adapter into monitor mode and capture the air. Useful, but you're looking at encrypted 802.11 frames, and the good captures depend heavily on your specific chipset and drivers. It's a rabbit hole of its own.
- A physical tap on the Ethernet cable. You splice into the copper between the device and the router and listen. No configuration, no drivers, no cooperation from the switch. This is the one you can build for pocket change, and it's what I built.
If your target device is wired — a lot of set-top boxes, NAS units, hubs, and cameras still are — the tap is the most direct answer to the question.
Why a passive tap works, and why 100 Mbps is the trick
Standard Ethernet over Cat5e/Cat6 uses four twisted pairs. At 100 Mbps (100BASE-TX), only two of those pairs actually carry data: one transmits, one receives. That is the entire reason a cheap passive tap is possible.
Here's the move. You break the cable between device and router into a pass-through path, and you branch each of the two active pairs out to a separate monitor jack. One monitor jack sees the device's transmit pair. The other sees the router's transmit pair. Plug two capture interfaces in, merge the two directions in software, and you've reconstructed the full conversation. The device and router still talk to each other normally — you've only wired a listener onto the wire in parallel.
The pass-through path is wired pin-for-pin, straight through, so as far as the two real endpoints are concerned nothing changed. The monitor branches are receive-only by construction: there's no return path wired back, so your laptop can listen but can't talk onto the tapped link even if it wanted to. That's a feature. You cannot fat-finger a broadcast storm onto a network you're only observing.
The catch — and it's a genuine one — is that this trick relies on the link running at 100 Mbps. At Gigabit (1000BASE-T), all four pairs carry data simultaneously and in both directions on each pair using echo cancellation. A dumb passive tap can't cleanly separate that. You'd be splitting bidirectional signals across pairs you can't demux, and you'd be blind or worse. So a passive tap of this style is a 100 Mbps device, full stop.
In practice that means you often force the link down to 100 Mbps on purpose — many devices will happily fall back, and honestly a doorbell does not need a gigabit. If yours refuses to negotiate down, this design isn't for that link. That's the first "it depends."
Building it: the parts, the pins, and the breadboard confession
The bill of materials is almost embarrassing. Four RJ45 breakout jacks, some jumper wire, and a breadboard. That's it. No powered components — passive means passive.
The wiring, using the T568B pin scheme, comes down to this:
- J1 (device side) and J2 (router side) are wired straight through, pin for pin, so the live link is untouched.
- The device's transmit pair (pins 1 and 2) branches to monitor jack A, wired onto that jack's receive pins.
- The router's transmit pair (pins 3 and 6) branches to monitor jack B, wired onto that jack's receive pins.
That's the whole circuit. There's no clever silicon; the intelligence is in the topology.
Now the confession: a breadboard is not a printed circuit board, and I would not run a production network through one. Breadboard contacts add a few picofarads of parasitic capacitance and some contact resistance, and at 100 Mbps signal integrity is not nothing. I was ready to see CRC errors and mangled frames.
I didn't. Across a long capture, the tapped link kept passing traffic cleanly and my captures came through readable. At 100 Mbps the timing margins are forgiving enough that a few picofarads of breadboard slop don't push you off a cliff. For a passive listening tap on a home link, it's fit for purpose. If I were doing this every day I'd etch a proper board — but the point of building your own is that you don't have to, to find out what you wanted to know.
What my devices actually said
This is the payoff, and it's the part the €39 box can't give you: the specific, slightly unsettling picture of your own network.
Watching one wired media device at idle, the bulk of what it emitted was discovery chatter — SSDP announcements fired at the multicast address 239.255.255.250, over and over, essentially advertising itself to anything listening. mDNS queries. The occasional NTP sync. Idle does not mean silent; it means talking quietly to itself and to the neighbors.
What I could not read was the interesting part. The actual application payloads were TLS — encrypted. I could see who it talked to (destination IPs, SNI hostnames in the handshake, packet sizes, timing) but not what it said. That's the second big "it depends." A passive tap gives you metadata and shape, not plaintext. For understanding "is this thing phoning home, and to where," that's often enough. For "what exactly is it uploading," it usually isn't.
The practical bit: parts and a first-run checklist
Rough cost, sourcing individually:
| Part | Qty | Ballpark |
|---|---|---|
| RJ45 breakout jack | 4 | ~€1.40 each |
| Breadboard | 1 | ~€4 |
| Jumper wires | ~16 | scrap bin |
Call it under €12 against €39, and you learn the wiring instead of trusting a sealed box.
First-run checklist:
- Force the tapped link to 100 Mbps and confirm both endpoints still talk.
- Plug a capture interface into each monitor jack — you need both directions.
- In Wireshark, capture both interfaces and merge them, or capture separately and combine by timestamp.
- Sanity check for CRC/FCS errors first. Clean capture before you trust the data.
- Filter the noise (
ssdp,mdns) so you can see the connections that matter.
The one line to underline
The myth is that seeing what your devices say on the network requires expensive, gatekept gear. The truer version: for a wired link at 100 Mbps, the hardware costs about twelve euros and a soldering-free afternoon — what actually limits you isn't the tap, it's the encryption on the other end.
