The other option is sniffing the data passively, which can be accomplished using a hub, switch with span, or a DIY passive tap.

The device could be an Ethernet bridge, which would allow not only to sniff but also filter, mangle or inject new data. The most common and obvious way to tap a ethernet cable is cutting it, and re-crimping or punching down the two ends to a sniffing device. The assumptions are that the network is Ethernet over twisted pair cabling, and the wiring is physically accessible. There are several ways of going about doing a physically wiretap. So What? Well, this opens up a Vulnerability allowing for Physical Wiretapping. Most installations will employ proper wireless security measures, but nothing for the data sent back over the wire after being received by the AP. This indirectly affect wireless networks as well, as the Access Points are still connected via a wired network. Don’t take my word for it, just lift a ceiling tile in any hallway and take a peek for your self. Unfortunately in most cases, little or no thought given to the physical security of the wiring. Almost every building is wired inside out, from businesses to schools to hotels. Wired networks are everywhere whether you like it not. Written by Janitha Karunaratne on Dec 24, 2009

Splice earthnet cable