A network tap is a device placed inline between two network endpoints that forwards
all traffic unmodified while making a copy available for capture — the hardware
embodiment of a passive man-in-the-middle. Commercial taps cost hundreds to
thousands of dollars; a Raspberry Pi 4B with one or two USB-to-Ethernet adapters
does the same job for under ~$100, at 1/8–1/30 the price of market devices, and a
2025 peer-reviewed evaluation found a Pi-4-based tap captured packets losslessly
compared against a Beckhoff ET2000 reference device. 1
This was one of the durable ideas mined from the broken 2021 “Pi 4B hacking
accessory” spell (and the owner’s journal notes on a DIY tap). The concept is
stable; the configs below reflect known-good 2023–2026 practice. For the
complementary control-plane pattern — plugging the Pi into a laptop as a USB
Ethernet device — see raspberry-pi-usb-gadget-mode.
Reference bill of materials (Pi 4B inline tap)
Raspberry Pi 4B (4 GB is plenty) + official or PoE+ HAT power
1–2 USB-to-Ethernet adapters (second one only needed for port-mirror output mode)
Optional: USB drive (exFAT/ext4) for pcap storage, RTC HAT for correct
timestamps when the device is powered off, dtoverlay=gpio-shutdown button for
safe field shutdown, OLED + mode button for headless status
Core architecture: transparent bridge + capture
Every current design shares the same skeleton: bridge eth0 (onboard) and eth1
(USB adapter) into br0 with no IP of its own, then capture on the bridge. The
bridge forwards at L2, so the tap is invisible — no speed negotiation degradation,
no IP footprint on the tapped segment:
Launched from a oneshot systemd unit ordered After=network-online.target, this
gives a plug-and-play inline tap: boot, bridge, capture to a USB drive with 1 GB
pcap rotation, safe-shutdown button, retrieve the drive offline. On Bookworm, note
that bridge-utils/brctl still works but the rest of the network stack is
NetworkManager — keep the tap interfaces out of NM’s control (or manage the bridge
via nmcli) and treat the device as unreachable-by-design over the tapped
network. 2
Three operating modes
Wesley Kent’s v2 build is the most complete current design, switching modes with a
case button:
Tap-to-disk — tcpdump -i br0 writing rotated pcaps to a USB drive (use
-C for file-size rotation and filter chatter like ICMP/ARP/broadcast to save
space). Best for drop-and-walk-away collection.
Port mirror — instead of storing locally, mirror the bridge one-way out a
second USB-Ethernet adapter to an analyst laptop running Wireshark, using tc:
tc qdisc add dev br0 ingresstc filter add dev br0 parent ffff: protocol all u32 match u8 0 0 \ action mirred egress mirror dev eth2ip link set dev eth2 promisc on
Both the tap’s output interface and the receiving interface must be
promiscuous. Add a udev rule pinning adapter names — on reboot the USB
adapters can enumerate in swapped order (eth1↔eth2) and silently break the
mirror.
Mini-switch / IP-phone mode — eth0 takes DHCP while the bridge stays
open, giving a downstream device network access (useful for justified
presence on the segment, but no longer passive). 3
Management plane
Because a correctly configured tap has no address on the tapped segment, current
builds manage it out-of-band:
Ad-hoc Wi-Fi AP on wlan0 (hostapd + dnsmasq serving link-local DHCP), SSH
in to pull pcaps — workable but radio-emissive; fine for blue-team use on your
own network, wrong for covert placement.
Serial console (GPIO 9/10, or USB-to-TTL) — fully passive.
USB gadget mode as the management interface is the natural modern pairing:
the tapped Ethernet stays a pure bridge while a laptop gets SSH over the USB-C
gadget link (raspberry-pi-usb-gadget-mode), with pcaps exfiltrated over the
same cable. This is the cleanest reunification of the old spell’s two ideas.
Turnkey option: sPIffer
sPIffer packages the Bookworm-era
design as a .deb: transparent promiscuous bridge between two Ethernet
interfaces, tshark capture, and an HTTPS web UI to start/stop captures and
download pcaps, with systemd services for the bridge and the web server. The
older minimal alternatives — botherder/ntap (bridge + rc.local tcpdump, shutdown
on adapter unplug) — still work as schematics but predate Bookworm’s
NetworkManager switch, so port the interface config rather than copying the
files. 45
Limitations and honest caveats
USB bus contention: the Pi 4B’s onboard Ethernet shares the PCIe-attached
internal bus architecture with USB 3; a bridged tap with a USB adapter and USB
storage can drop packets under sustained gigabit load. The 2025 study showed
losslessness on its testbed, but expect degradation near line rate — a Pi 5 or
limiting capture filters helps.
Only sees what crosses the wire: an inline tap between a host and a switch
sees that host’s traffic, not the whole segment — for broader visibility you
want a switch SPAN/mirror port feeding the Pi instead (promiscuous capture on a
single interface, no bridge).
Encryption: a tap observes metadata and cleartext only; it is a visibility
tool, not a TLS-breaking one. For active credential interception on the wire,
see ntlm-relay-attacks — that requires an active MitM position, not a
passive tap.
Legality/consent: inline interception of third-party traffic is heavily
regulated; these builds are documented for monitoring your own devices, lab
work, and authorized engagements.