What is it?

A device that captures data flowing through a computer network and outputs a PCAP capture file to a USB drive. It has two Gigabit Ethernet ports. The tool is installed in between the network cable of the device that you wish to tap. It will not interfere with the traffic in between (see limitations below).

Why did you make it?

I wanted to capture network packets for troubleshooting purposes without connecting bulky Ethernet cables to my computer, setting up monitor / SPAN ports on switches, or having to manually start, stop, and save captures with Wireshark.

What makes it special?

It captures network packets straight to file on a USB drive, unlike other network taps that just mirror traffic to another Ethernet port.

It will pass 1Gbps of traffic, unlike unpowered "passive" network taps that are limited to 100Mbps.

It is very small and light.

Features

• Autonegotiate 10/100/1000Base-T on both ports, with auto-crossover.
• Simple plug and play - no settings, no configuration.
• Durable USB-C power in port (5V/2A), can be powered by a computer's USB port
• 802.1X passthrough (works with NAC - Network Access Control)
• Works with just one port plugged in if connected to a monitor/SPAN port
• Invisible network tap - no IP address, cannot be accessed from network
• USB 2.0 data port for connecting USB flash drive
• Multiple USB filesystem support: exFAT, NTFS, and FAT32 tested
• LEDs indicating power, USB, and network/link activity
• ~30 second boot time from power on
• Software upgradable - uses SD card as boot drive

Included

• The circuit board
• 3D printed case
• SD card with software pre-programmed

Not included

• Ethernet cables
• USB flash drive
• USB-A to USB-C power cable
• USB-C to USB-C power cable

Limitations

• No PoE (Power over Ethernet) passthrough
• No jumbo frame passthrough
• No power-off bypass - network connectivity only when booted up
• No link-state passthrough
• USB 2.0 data port has limited write speeds (80-240 Mbps). There is a 407 MB buffer for the packet capture. Packets that exceed the capture buffer will still pass through but will be missing from the capture.
• No persistent clock - LittlePcap will try to use NTP (Network Time Protocol) to a Google server. NTP packets are also inspected to obtain the time. If both methods don't work, the timestamps will show as a time in the past.
• Some special traffic is blocked from passing through (STP/LACP/Pause frames), but may still show up in the packet capture file.

Instructions for use:

• Connect a computer or USB power adapter to the USB-C power port of LittlePcap. The red system light will flash while booting and turn solid after booting is complete.
• Connect LittlePcap with one Ethernet cable to the device being monitored, and another cable to the router or switch.
• Connect a USB flash drive to the USB-A port. The capture will automatically start if LittlePcap is booted up. Hotplugging is also supported, so you can insert the flash drive at any time.
• Remove the flash drive and insert it into a computer with Wireshark installed for packet capture analysis. It is recommended to "scan and fix" the USB drive when prompted by Windows to minimize the time needed for LittlePcap to mount the drive when plugged in.
• LED indicators from top to bottom: Green link light for the top Ethernet port, green light to indicate a USB device is plugged in, red power/system light

Troubleshooting

• If PCAP files do not show up on the USB drive, the drive may have an unexpected partition table format. I suggest reformatting the drive using FormatUSB with the exFAT filesystem.