Network Tap

Gaining Direct Network Access - The “Network Tap” Strategy

---
config:
  layout: dagre
---

flowchart LR
 subgraph subGraph0["MikroTik Bridge"]
        J(("bridge-tap"))
        D["MikroTik Port 1"]
        F["MikroTik Port 2"]
  end
    A["Indoor Unit (PoE Out)"] --> B["Cable"]
    B --> C{"Splitter Cable RJ45 Male"}
    C -- Data (RJ45 Male) --> D
    C -- 12V DC (Male Plug) --> E{"Injector Cable DC Female Jack"}
    F -- Data --> E{"Injector Cable" RJ45 female}
    E -- PoE Out (RJ45 Male) --> I["Roof Unit (PoE IN)"]
    D --- J
    F --- J

• Challenge: The Mikrotik Chateau (intended controller, residing on a separate subnet, e.g., 192.168.69.x) needs direct network access to the roof unit’s API on the 192.168.10.x subnet. The indoor unit normally acts as a router/firewall, isolating these networks.
• Proposed Solution: Physical “Network Tap”
  • Location: Placed on the Ethernet cable running between the indoor unit and the roof unit.
  • Construction Concept (using an Ethernet extension cable as a base):
    • PoE Pass-through: The Power over Ethernet pairs (typically Blue/Blue-White and Brown/Brown-White – pairs 4,5,7,8) must be carefully isolated and left electrically continuous to ensure the indoor unit can continue to power the roof unit.
    • Data Interception: The data pairs (typically Orange/Orange-White and Green/Green-White – pairs 1,2,3,6) are to be cut. Each of the four resulting ends (two towards Indoor Unit (RV2458), two towards Roof Unit (MV2402)) will be terminated into keystone jacks.
    • Rerouting Data: This allows the data path to be routed from the indoor unit’s port, into one port on the MikroTik, out another port on the MikroTik, and then to the roof unit (or via an intermediary switch connected to the MikroTik).
• Objective of the Tap: To place the MikroTik router (or at least an interface of it) onto the same Layer 2 network segment (192.168.10.x) as the roof unit.
• Anticipated Benefits:
  • Allows direct API calls from the MikroTik to the roof unit.
  • Still utilizes the indoor unit for PoE power delivery to the roof unit.
  • Enables the MikroTik’s packet sniffer tool to capture and analyze traffic between the indoor and roof units for deeper understanding.
• MikroTik RouterOS Configuration Outline (for the tapped interface):
  1. Create a new bridge interface (e.g., bridge-rvlink).
  2. Add the two physical Ethernet ports (connected to the tapped data lines – one from indoor unit’s side, one to roof unit’s side) as ports to this bridge.
  3. Assign a static IP address from the RVLink’s internal subnet to the bridge-rvlink interface (e.g., 192.168.10.2/24). This allows the MikroTik to communicate on that network.
  4. Potentially add a default route 0.0.0.0/0 pointing to the roof unit’s IP (192.168.10.254) when the RVLink system is intended to be the active internet gateway.