Making a passive network tap can be an easy and inexpensive
undertaking as shown in this Instructable. Passive monitoring or
port mirroring is needed because most networks use switches
which isolate the network traffic and this does not allow for
the entire network to be monitored. This example uses a single
tap, using multiple taps will provide access to the full-duplex
data separately. By using two taps you are able to monitor
inbound data that is passed through one tap, and outbound data
that is passed through the other tap. Separate taps are desired
because most sniffer software handles half-duplex traffic only
and requires two network cards for full-duplex. It is easy to
insert a passive Ethernet tap inline, as shown in the picture
above from a different multitap project, simply plug the
incoming line into a host port and a patch cable from the other
host port to the outgoing port, then verify your connection
status. Now connect the Ethernet port of your sniffer computer
into either of the tap connectors