A network sniffer, also known as a network Test Access Port (TAP) allows you to view the data on an ethernet link. Packets flowing through the NETWORK ports are duplicated to the TAP port. The TAP port is typically connected to a PC running Wireshark. or similar software.

The SharkTap works with CAT-5 type cables, not with fiber optic ethernet. Specifically, it works with 10, 100, and 1000Base-T ethernet links.

The SharkTap is designed to be "like it's not even there" to the link it is monitoring. We use a copper repeater architecture that introduces virtually zero delay and is protocol agnostic. The SharkTaps are not SPAN ports or switches with port mirroring. They copy data at the bit level, and can duplicate data that isn't even proper IP packets. The SharkTaps are "aggregate" taps, meaning that they combine packets from both network ports and send them to a single TAP port. This is more convenient than taps that require two NICs on the your PC, but is not optimal if your link will have sustained total data rates above 1Gb/sec.

Why not just use a standard switch to add a port? Conventional switches route packets only to the intended destination port, reducing traffic, but preventing a third port from seeing all packets. You need something to duplicate all packets to or from the 'NETWORK' ports on the 'TAP' port.