SharkTapUSB features

SharkTap

Adds a virtual USB NIC to the SharkTap

  • The same features as the SharkTap 10/100/1G, with the addition of a built-in ethernet USB 'dongle'.

  • Ideal for thin laptops or tablets with no wired ethernet jack. Minimize the equipment you must carry to troubleshoot.

  • The USB port has advantages even when you have a wired port - You can configure the USB port to optimize data capture. No need to swap a wired port between capture and networking

  • A wired TAP port is still available if you want to capture that way.


SharkTap

Simple plug and play

  • Includes a USB 3 micro-B cable. Plug into any USB 3 port (typically with a blue insert) for power and virtual NIC device.

  • Can be connected to a USB 2 port, but with reduced capture throughput (300-400Mbps).

  • You can optimize the virtual ethernet port for Wireshark or equivalent, leaving other ethernet ports configured for networking.

  • If using only the wired-TAP option, you can power the box from a micro-B cable (phone charger or equivalent)

  • You'll need a couple of CAT-5 (or equivalent) patch cords (not included).


The SharkTapUSB can double as a dongle for connecting to a wired network. This mode is enabled by disconnecting both Network ports, and connecting both USB and wired TAP ports. The USB port is then cut through to the wired TAP port.

SharkTapUSB Specifications

  • Directly supports 10Base-T, 100Base-T, 1000Base-T links

  • ASIX AX88179 based USB TAP port. Standard driver support in all mainstream operating sytems.

  • Dimensions (including tabs): 2.9"W x 5.1"L x 1.10"H

  • Passes Power Over Ethernet (PoE), 350mA per pair (at 57V)

  • Draws up to approximately 750mA, depending on link speeds.

  • Temperature range: 0 to 70 Celcius. Nominal range - not formally guaranteed

  • Warranty: 30 day return, 1 year defects in parts and workmanship

SharkTapUSB materials

Quick Start Guide

EU Certificate of compliance

Regulatory summary

USB Setup tips

Frequently Asked Questions


Is the SharkTap an aggregate tap?

  • Yes, the SharkTap will 'aggregate' packets from the two NETWORK ports and mirror (i.e. duplicate) them on the tap port. If two packets are received at the same time they will be duplicated sequentially on the tap port. The SharkTap has a large 128KB buffer to absorb bursts of full duplex traffic.

Does the SharkTap respond to flow control packets?

  • The design goal of the SharkTap is to not respond to any packet, but merely copy it intact. However, there are a couple of exceptions: The Broadcom switch chip 'eats' any packet to multicast address 01:80:c2:00:00:01 (the address set aside for PAUSE frames). There doesn't seem to be any way around this, so PAUSE packets will not be seen on the gigabit tap - you won't see them on the Tap port, and a PAUSE packet will not be forwarded to the second NETWORK port.

  • There is a second issue you might need to be aware of: If the destination and source MAC address are the same, the packet will not be forwarded. You WILL see the packet on the Tap port, but it won't be forwarded to the second NETWORK port. Having a destination address equal to the source address is an invalid ethernet packet, but sometimes a software error will generate a packet of all zeros. So you'll see this bogus packet on the Tap port, but it won't get forwarded over the network.

Will the SharkTap "fail open"?

  • Yes - if the SharkTap loses power, the Network link will stop working

Does the SharkTap support Power over Ethernet?

  • Yes, it does. The center tap of of the isolation transformers for each pair are connected to the corresponding center tap of the other NETWORK port. So the high speed data is blocked, but DC power is passed through. This is done for all four pairs, so all standard PoE techniques are supported. There are no settings, it just works.

Will the SharkTap show packets with bad FCS?

  • If the 4 byte IEEE 802.3 checksum at the end of the frame is bad, no, the packet will be dropped. The SharkTap will pass frames with bad checksums within the protocol headers.

Can the SharkTap drop packets?

  • Yes, but only on the TAP port. The SharkTap has fairly large data buffering, but if the sustained, combined data rate of send + receive data is greater than 1000Mbps, the SharkTap will not be able to duplicate all packets to the TAP port, so some packets can be dropped. This is not common in real world connections, but it can happen.

Is the SharkTap a hub?

  • No. The SharkTap is a switch that is pre-configured for port mirroring, or 'sniffing'. The most important distinction is that the SharkTap will not pass packets from the TAP port to the Network ports. So you cannot access the network you are monitoring, from the monitoring PC.

Is there any reason to get this gigabit tap if I'm only doing 100Base-T?

  • If a full-duplex 100Base-T Network is heavily loaded, yes. The total bits/second is the sum of both Network ports, and if that total exceeds 100Mpbs, there will be delays as packets are funneled to the 100Mbps Tap port. Having a gigabit Tap port insures that there will be no delays monitoring a fully loaded 100Base-T network.



Back