Skip to main content

Plunder Bug LAN Tap — The Complete Guide

一句話定位：Plunder Bug 是一台口袋大小的「乙太網路竊聽器」——把兩條網路線穿過它，它把流量鏡像給你的電腦，你用 Wireshark 就能看穿這條線上的所有封包。USB-C 供電，Windows / Mac / Linux / Android 都能用。

The Plunder Bug is the network side of Hak5's physical-access toolkit: a tiny LAN tap that sits on an Ethernet link and mirrors traffic to your analysis computer. It works in two modes:

  • Passive mode — silently mirror the traffic on the tapped link to your laptop.
  • Active mode — inject your analysis device into the network (it becomes a simple switch/host) for active scanning.

Because it's USB-C powered with the ASIX AX88772C chipset, it works across platforms with tiny cross-platform scripts — and even with an Android root app for on-site mobile capture. It pairs perfectly with Wireshark for analysis.

⚠️ Authorised testing only. Tapping a network link you don't own is illegal. Use on your own lab network or with written permission.

Specs at a glance​

ItemSpecification
Network interface2× 10/100BASE-T Fast Ethernet, auto-negotiation (up to 100 Mbps)
USB interfaceUSB-C (tap + power, 5V, 20–300 mA draw)
USB Ethernet chipsetASIX AX88772C
ModesPassive (mirror traffic) / Active (inject into network)
Analysis softwareWireshark & other open-source analyzers
Mobile supportAndroid root app for on-site pcap capture
Official docshttps://docs.hak5.org/plunder-bug

Anatomy​

PartPurpose
Ethernet port AOne side of the tapped link
Ethernet port BOther side of the tapped link
USB-C portConnect to your analysis computer (power + data)

Passive vs active — the two personalities​

ModeWhat happensBest for
PassiveTraffic A↔B mirrored to your laptop; the link keeps workingStealthy "what's on this line?" sniffing
ActiveYour laptop joins the network through the BugActive scanning, ARP work, service discovery

Quickstart — sniff with Wireshark​

Step 1 — Wire it up​

  1. Connect one Ethernet end to a device/switch (lab network!).
  2. Connect the other Ethernet end to a second device.
  3. Plug the USB-C side into your laptop.

Step 2 — Load the connection script​

Hak5 ships cross-platform connection scripts. On Linux:

# Run Hak5's provided setup script, or configure manually:
sudo ip link set dev usb0 up
sudo dhclient usb0            # get an IP for active mode

For passive capture, the interface appears automatically (e.g. usb0 / a new Ethernet adapter on Windows or macOS).

Step 3 — Capture in Wireshark​

Start Wireshark on the new interface and capture:

$ wireshark                      # or tcpdump -i usb0 -w capture.pcap

Watch traffic on the tapped link appear live.

Step 4 — Switch between modes​

Toggle passive/active per the mode-switching instructions for your OS (Windows / Mac / Linux scripts included with the device).

Hands-on: see it work on your own lab​

To prove passive capture works, generate traffic:

# From a device on the tapped link, ping something
ping -c 3 8.8.8.8

In Wireshark you should see the ICMP echo requests/replies traversing the link. That's your tap doing its job.

Advanced​

CapabilityHow
Passive mirroringNo IP needed on your laptop — just sniff the mirrored frames
Active injectionBring your laptop onto the network for active recon
Mobile pcapAndroid root app captures .pcap on the go
Protocol analysisFeed captures into Wireshark / tcpdump
Simple switch useChain it to bridge a segment without analysis

Troubleshooting​

SymptomCauseFix
No traffic in WiresharkInterface wrong / link not activeVerify the new interface name (ip link); ensure Ethernet links are lit
Laptop gets no IP in active modeDHCP not reachingSet a manual IP matching the segment
Windows driver missingASIX driver not installedInstall the ASIX AX88772C driver, or use the provided script
Android not seeing itApp needs root + OTGUse the Android root app; enable USB OTG
One side no linkCable or port faultSwap/test both Ethernet ends independently