Review – DualComm – Ethernet Tap

I saw mention of the DualComm Ethernet switch/tap on my twitter feed a few weeks back from @Pauldotcom.  It is really difficult to sniff traffic without a hub or business level switch.  Or you could do a pass through feed using a dedicated pc.   The DualComm tap provides a very simple and affordable way to tap traffic by putting a port replicator feature in a small switch.

So I ordered the USB Powered 10/100 Ethernet Tap DCSW-1005.  It cost $59.95 and they take paypal.

Ethernet Tap
Ethernet Tap

It works like a champ.  I plugged it into a spare apple usb power plug where all my network hardware is.  Then I patched the cable from my router wan port to the port two of the switch.  Port one then went to my cable modem.  I tested and found all my Internet connectivity works fine without issue or performance hit.  Then I just plugged the port five from the Ethernet tap to a old Thinkpad laptop I have for such things.  I did have to order a Linksys USB Network adapter to have the second interface on the Thinkpad for sniffing the traffic.  The onboard nic is used for normal network access, ssh, etc.  Testing Ntop, Dsniff, URLSnarf etc all work perfectly.  It was amazing that I could not find the USB wired network adapter in any local stores.  I had to order that Linksys adapter from Amazon.

All said and done.  The DualComm DCSW-1005 works great!  And having it be usb powered means no dedicated power adapters to be lost or mislabeled.  If you need an Ethernet tap for your security work this is a great find.

PS If you are like me and forget how to put an interface into promisc mode under Ubuntu linux.  Andrew Hay has a great post on promisc mode setup I keep handy.