why the length of an RJ45 cable can affect the passive network tap's function

2

I made a passive network tap to capture Ethernet packets with wireshark,and I followed the instruction of this article

at first,this passive network tap works fine. This tap has four ports, first port is connected to HostA(called HostA port), second port is connected to HostB(called HostB port); The other two ports(called NIC portA and NIC portB) is connected to my labtop which has two NICs, with the all devices connected, I can capture the packets between HostA and HostB,and won't affect the communication between HostA and HostB.

But there is a abnormal condition:

Step1 HostA and HostB is connected through the network tap, the ethernet communication between them is good(ping -t continuely)

Step2.1 Then I plug a 50cm RJ45 cable into the NIC portA of the network tap,just a cable ,wich another cable head unplugged.Weird things happened, the communication between HostA and HostB failed(ping failed).

Step2.2 then I plugged the other head of this 50cm RJ45 cable into my labtop, communication between HostA and HostB recovered, and I can capture one-way packets

Step2.2 or,instead of this 50cm RJ45 cable,I plugged a shorter RJ45 cable(like 10cm) into NIC portA of the network tap (with other head unplugged),the communication between HostA and HostB won't fail.

the RJ45 cables and network tap are checked,there're no problem. I don't think radio wave can cause this,I think this a kind of impedance matching problem. so why this happens? should I consider the NIC communication at the physical layer?


I know @David Schwartz is talking about the transmission line theory, this happens when the signal's wavelength is close to or shorter than the line's length. It's true that** " A line that ends with an open circuit or a short circuit will reflect most of that signal back towards the source"** , but the situation now is "to HostB ,the end is an open circuit( 50cm RJ45 cable) in parallel with HostA' NIC; and vice versa " . So it's not the ideal situation,according to transmission line theory, reflection coefficient can be calculated. But first I should know the the twisted-pair's characteristic impedance,the signal frequency, and the NIC's impedance at this frequency, but I'm not sure how to measure or estimate these parameters.

Kaogula

Posted 2017-02-17T12:28:16.820

Reputation: 21

>

  • what are the other cable lengths (from tap to HostA and tap to HostB)? 2) approximately what ping timings are you observing?
  • < – quixotic – 2017-02-17T12:33:13.577

    1Yes you should. As you already said your likely influencing the impedance/resistance by attaching the longer cable. The impact with a shorter cable isn't as noticeable so it continues to work. If you plug it into a network interface you suddenly get proper termination again. In addition your Notebook is already influencing the communication. That setup is just a purely passive hub. – Seth – 2017-02-17T13:17:51.483

    2A passive tap like that can only work for 10/100 Ethernet, not Gigabit. 1000BASE-T uses all 4 pairs for both send and receive from both ends, and and an intermediate observer would never be able to make sense of the signals. If your equipment is gigabit capable, I recommend not hooking up the blue and brown pairs at all, so that the devices are forced to use 10/100. – Spiff – 2017-02-17T17:30:37.427

    @quixotic cable lengths from tap to HostA and tap to HostB are both no longer than 5m, the ping timings are less then 1ms – Kaogula – 2017-02-18T02:13:18.560

    Answers

    2

    This is not surprising at all.

    Step1 HostA and HostB is connected through the network tap, the ethernet communication between them is good(ping -t continuely)

    This makes sense. Sure, you have some extra stub wires, but they're not having any significant effect.

    Step2.1 Then I plug a 50cm RJ45 cable into the NIC portA of the network tap,just a cable ,wich another cable head unplugged.Weird things happened, the communication between HostA and HostB failed(ping failed).

    This is not surprising. Signals travel down the long wire, bounce off the end, and come back. By the time they come back, the network is trying to send the next bit, and it gets interfered with by the reflected signal.

    Step2.2 then I plugged the other head of this 50cm RJ45 cable into my labtop, communication between HostA and HostB recovered, and I can capture one-way packets

    This is not surprising. The properly terminated cable absorbed the signals rather than reflecting them, so there was no interference.

    Step2.2 or,instead of this 50cm RJ45 cable,I plugged a shorter RJ45 cable(like 10cm) into NIC portA of the network tap (with other head unplugged),the communication between HostA and HostB won't fail.

    Again, not surprising. Because the cable was shorter, the reflections were received sooner, while still sending the same bit. So there was no interference with the next bit.

    Properly-terminated high-speed communication lines absorb the energy of the transmitted signal to minimize reflections that can cause interference. A line that ends with an open circuit or a short circuit will reflect most of that signal back towards the source, delaying it due to the length the signal travels.

    This is exactly what I would have expected.

    David Schwartz

    Posted 2017-02-17T12:28:16.820

    Reputation: 58 310

    I agree with your analysis of the effects of how the circuit is treating these, especially reflection. My answer didn't include anything much about the reflection issue. I'm not sure where it would fit, but if someone can figure where it would go, edit my answer to add the reflection effects, and give @David-Schwartz credit. – DaaBoss – 2017-02-17T18:01:39.627

    2Bridged taps (and signal reflections) are a common issue in the landline telephone system. No problem for (low-frequency) voice transmissions, but when T1 service was introduced, this practice was exposed as a problem. – sawdust – 2017-02-17T19:29:33.327

    It's true that** " A line that ends with an open circuit or a short circuit will reflect most of that signal back towards the source"** , but the situation now is "to HostB ,the end is an open circuit( 50cm RJ45 cable) in parallel with HostA' NIC; and vice versa " . So it's not the ideal situation. – Kaogula – 2017-02-18T03:20:30.080

    0

    The idea of your tap is to be able to physically connect the transmissions of either PC to an additional NIC, so physically, you have to connect that physical wire to TWO NICs simultaneously. However, you don't want to send anything since it not only could be detected, but you'd probably mess up the signals, if returning traffic from two NICS on the same wire. (There's a reason only one NIC sends and the other NIC does NOT try to send anything back over that same pair.)

    So, you are essentially reading the one-way traffic and sending each one to a different NIC in your laptop, and not connecting any of your laptop send lines to that connection between the two NICs.

    • You connected the wires that only SENT from A to B to your READ lines on ONE of your NICs in your Laptop.
    • Next, you connected the wires that sent from B to A to your READ lines on your OTHER NIC in your laptop.

    I see several issues already, which could cause problems, one of which you already saw by accident. When you take any wire and connect it up to some source and not the other, by definition, you've created an antenna. I won't go into all the science of antennas, but they really are weird and hard to predict what effects it will have on where you connected, since there are a ton of factors involved. One characteristic of course, is it will collect ANY and ALL RF and deliver it back to your two PCs. So, with the long wire, you probably collected a frequency RF that was more tuned to that length of wire, and sent it back to the NIC, which confused the listener on the wire pair.

    Rule one--Don't leave wires connected to any AC line and expect that you aren't collecting stray signals and introducing who knows what back into the electronics. Of course, you are likewise TRANSMITTING all the network traffic into the air that could be captured by anyone that wanted to listen as well.

    Rule two--Don't connect just one wire, or even a pair of wires to another device that is not ALSO grounded to the same place. I've seen as much as 12 volts difference between grounds in the SAME building, which is hard to spot. There's a reason there are THREE wires there. The big one is supposed to be connected to the same EARTH ground as all the others. The next largest of the three is "regular ground", which is supposed to be the same as the other ground, but for a variety of reasons may NOT be the same. Worse, that second tier ground is really one of TWO SEPARATE grounds, once they leave the box that is coming into your building. ie., each separate ground WILL NOT be exactly ground, when you connect a motor anywhere to that side of the 220. (You get 110v by only using 2 of the 3 incoming 220v lines). Conclusion: When two devices aren't working as suspected, especially when connected from two different rooms, find someone that knows how to troubleshoot and look for powerline differences.

    Rule three--Unless you are designing, you likely don't have to worry about these:

    -- You must usually "terminate" the lines in any communication circuit. In the SCSI world, we applied a small voltage AND a resister to any long wire run, (more that a foot or so). If we didn't, that "antenna factor" kicked in, and the signal that was sent, collected garbage by the time it got to the other end of the wire. The methods mentioned, dampen that and make everything work, most of the time.

    -- If possible, to prevent problems, use an additional ground wire, if available. I haven't looked at the wired Ethernet spec lately, but I'm surprised that they didn't connect the ground wire to each of your laptop NICs. Check it out, and if possible add that.

    -- Make sure the circuit you are connecting to can handle more than the two devices you have. You just added a third device. Think about it... What happens what you put a splitter on your earphones, listening to one set, and then connect the seconds set? Correct--the volume decreases. Connect a bunch, and you'd be shorting it out, possibly destroying the circuit--but you'd certainly not hear anything at all when doing so. The identical problem could happen for instance, if your tap connected to a PC that was on 800 feet away, when that circuit was only designed to carry the signal 1,000 feet without another amp or repeater.

    Be aware that your tap could introduce problem on your network. Without isolation circuits, it certainly is detectable. To prevent problems, NEVER plug your wire into your tap, before your laptop. As you could see, you will at least be breaking their connection. Since I probably got a few things wrong here, to any of you IEEE guys out there, please feel free to edit this and correct it. Just please add a comment to me so I can learn from what you changed.

    DaaBoss

    Posted 2017-02-17T12:28:16.820

    Reputation: 1 931

    Most inside-use Ethernet cables and the plastic plugs don't have a ground connection at all – only shielded plugs connect the metallic outer shield to ground, AFAIK. (Though, while I'm not sure whether it's for avoiding ground problems, Ethernet cards do use magnetic coupling inside.) – user1686 – 2017-02-17T19:35:58.640

    And regarding "There's a reason only one NIC sends and the other NIC does NOT try to send anything back over that same pair" – in Gigabit Ethernet they actually do exactly that. The additional data pairs are bidirectional. – user1686 – 2017-02-17T19:37:10.003

    1

    @quixotic The Ethernet standards require magnetic coupling and magnetic coupling only works with AC.

    – David Schwartz – 2017-02-18T07:28:42.710