Passive Network Tap

A project log for Network Usage Meter

A real time display of current network usage. Data displayed on LED matrix and sent over serial UART to host for plotting.

bonafidegeekbonafidegeek 08/13/2014 at 01:160 Comments

I created a prototype passive network tap out of female RJ-45 push down sockets. Under normal conditions, data is transmitted on TX and recieved on RX, however when sniffing traffic on a line, the listening device must treat each direction as seperate receive channels. To handle two RX channels, two NICs are required.

10/100Base-T Passive Network Tap

I ran into Mike Ossman at a GNU Radio conference and received one of his Throwing Star LAN Tap. He uses them as business cards, how cool is that? If I ever get around to populating the board, it will certainly clean up my protyping efforts a bit.

MAC + PHY chip

The bandwidth meter operates at the ethernet frame level, counting bytes transmitted and received (including headers). As such, I looked for a MAC + PHY chip with a large receive buffer and the ability to handle raw ethernet frames. I first looked at the

WIZnet module, but found it's raw ethernet support lacking. The interface could only store one raw ethernet frame at a time and block any incoming packets until the first frame is read. For this application, the blocked packets would lead to an incorrect byte count and defeat the purpose of the meter.

I ultimately selected the ENC624J600 chip.

Unlike the WIZnet module, the ENC624J600 does not have a built in TCP/IP stack, but had a much better raw ethernet interface. I ordered a single

Olimex breakout module from Mouser to get going. I planned on making a PCB with two ENC624J600 chips and some flavor of Atmel to keep track of the packet count and drive the display. The SPI IO pins on the ENC624J600 are 5v tolerant and the Atmega128 recognized ~3.3v as high, so the level shifters weren't needed.