Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Test segmentation by checking representative, explicitly permitted and prohibited connections across each important boundary, then corroborating the results with the enforcing control’s configuration and logs. A timeout alone does not prove a block: the destination, service, route, or test path may be unavailable. Get written authorization and agree on safeguards before sending probes, especially around OT, legacy, or safety-critical systems.
What a segmentation test needs to prove
A VLAN name or network diagram does not establish that traffic is actually constrained. The boundary is effective only if the firewall, access control list (ACL), endpoint policy, or other enforcing control applies the intended rules to real traffic. A useful test therefore answers two questions for each flow: did the connection behave as policy requires, and is there evidence showing how the control handled it?
Test both sides of each critical boundary from approved, representative endpoints. Depending on the environment, relevant zones may include user devices, servers, management networks, a demilitarized zone (DMZ), cloud-connected networks, and operational technology (OT). Include remote administration services or shared resources only when they are in scope and relevant to the actual design; do not treat a generic port list as a universal policy.
1. Set authorization, scope, and stop conditions
Obtain written approval from the network and system owners before testing. Define the exact networks, source and destination hosts, test window, allowed methods, escalation contacts, data-handling expectations, and conditions that require testing to stop. NIST SP 800-115, published in September 2008, treats rules of engagement as part of planning a security test; it remains a methodology reference, not a current product-configuration guide.
#1 Best Overall
![Dualcomm10/100/1000Base-T Gigabit Ethernet Network TAP [ETAP-2003]](https://m.media-amazon.com/images/I/41BN4VAnktL._SL160_.jpg)
- Network Tap for use with 10/100/1000Base-T Ethernet link
- Reliable and high performance. Tested with maximum in-line cable length (200m) at full 1Gbps data throughput with no single packet loss
- Capable of being powered from a computer's USB port with built-in inrush current limiting circuit to prevent the computer from possible damages or disturbances by instantaneous current surge
- Compatible with Power-over-Ethernet (PoE)
- Probably the smallest portable GbE Network Tap available on the market
- Use narrowly scoped sources and destinations rather than scanning broad address ranges by default.
- Agree who will observe the test and who can stop it if service behavior changes.
- For OT, legacy, or fragile equipment, coordinate with operators and system owners. Do not assume active probing is safe merely because it is routine on office networks.
2. Map the boundaries and expected flows
Start with the current network diagram and asset inventory. Identify each zone, the devices or policies enforcing its boundaries, and any alternate routes or connections through remote access, third parties, or cloud services. CISA recommends diagrams that capture major networks, addressing, topology, dependencies, and external connections.
For every source-zone and destination-zone pair in scope, record the required business traffic and the traffic that should be denied. Be specific about the service or protocol where it is known; broad entries such as “any” make the intended boundary hard to verify.
Rank #2
- (10/100/1G) Gigabit Bypass network tap / sniffer equivalent to port mirror on a switch.
- The two monitor/sniff ports are isolated from the network being monitored.
- Automatic bypass of device on power fail.
- Power-over-Ethernet (POE) pass-through. Rated at .75A max at 57vdc
- 5v power through USB3 port or 5v wall transformer (or both). ~500ma consumption.
| Source zone and test host | Destination zone and host | Service or protocol | Expected result | Enforcing control | Expected evidence |
|---|---|---|---|---|---|
| Approved source and zone | In-scope destination and zone | Business-required service | Allowed | Named firewall, ACL, or endpoint policy | Successful connection and corresponding policy or traffic record |
| Approved source and zone | In-scope destination and zone | Unneeded cross-zone service | Denied | Named firewall, ACL, or endpoint policy | Failed connection and matching deny record or alert |
These rows illustrate how to document a test; they are not a recommended access policy. Fill them with the actual systems, services, and controls in your environment.
Recommended Free Tools
3. Check enforcement and telemetry before testing
Inspect the control responsible for each boundary before generating traffic. Check that the intended rule is attached to the correct interface, zone, route, endpoint group, or policy scope. Look for broad allow rules, unexpected routes, alternate interfaces, shared management paths, and exceptions that could bypass the named boundary. CISA describes segmentation using controls such as ACLs, stateful inspection, firewalls, VLANs, and DMZs, and recommends logging denied traffic.
Rank #3
- 40% smaller than standard LAN tap
- Same Throwing Star LAN tap function in a new streamlined design
- Simple device for passively monitoring ethernet based communications
- Updated, intuitive silkscreen and streamlined design
- Every device assembled by hand in the USA with individual inspection and testing
Confirm that the relevant logs and monitoring are enabled and that someone can review them during the test. CISA’s OT guidance recommends monitoring key chokepoints, including connections between segments, and establishing normal traffic baselines before alerting on unexpected industrial control system traffic. Record the time standard used by the test host and monitoring systems so events can be matched reliably.
4. Test permitted and prohibited connections
From each approved source endpoint, attempt only the representative connections listed in the agreed flow matrix. Use the actual application or service where practical, so an allowed path is tested as users and systems depend on it—not merely as an abstract network route.
Rank #4
- Network Tap for use with 10/100Base-T link
- Capable of being powered from a computer's USB port with built-in inrush current limiting circuit to prevent the computer from possible damages or disturbances by instantaneous current surge
- Compatible with PoE. PoE pass-through between two inline ports
- Can also be used as a portable 4-port 10/100 Ethernet switch
- For an allowed flow: verify that the required business function works and that traffic traverses the intended boundary control.
- For a prohibited flow: verify that the connection fails and check whether the enforcing control logged or alerted on the attempt.
- For important paths with direction-specific policy: test each direction separately. Stateful inspection and asymmetric routing can make behavior differ by direction.
- Where endpoint identities, host rules, or routes differ: repeat from more than one representative source rather than assuming one workstation proves the behavior for an entire zone.
CISA’s 2022 advisory on state-sponsored Russian cyber actors targeting the energy sector describes lateral-movement methods that include remote services such as RDP, VNC, and administrative shares. Those are examples to consider when relevant to an environment, not a checklist to probe indiscriminately.
5. Distinguish a real block from an inconclusive failure
A client timeout, refused connection, or missing response is an observation—not, by itself, proof that segmentation blocked the flow. The destination may be powered off, the service may not be listening, the route may be missing, or the test may not have crossed the boundary under examination.
- Confirm through an approved method that the destination is live and that the service would respond. If needed, verify it using an authorized path that does not bypass or change the boundary being tested.
- Match the test time and available flow details—such as source, destination, protocol, and ports—to the firewall, ACL, endpoint-policy, or monitoring records.
- Confirm which rule or policy made the decision and whether the observed path crossed the expected control.
- If the endpoint or service cannot be verified safely, record the result as inconclusive rather than claiming the boundary blocked it.
NIST SP 800-115 explains that passive discovery can miss systems that do not communicate during observation, while active probing can be detected and may create risk on older or weak systems. These limits are why a negative probe needs corroborating evidence.
Best Value
- The SharkTap is a special purpose 10/100/1000Base-T ethernet device that allows you to 'tap into' an ethernet connection. It is intended to be used with the free Wireshark protocol analyzer or equivalent.
- Conventional switches route packets only to the intended destination port, reducing traffic but preventing a third port from seeing all packets. The SharkTap duplicates all packets to or from the Network ports to the TAP port.
- Supports 10, 100 and 1000Base-T, all ports. Power-Over-Ethernet (PoE) pass-through.
- Powered from a USB-B cable (included), draws 350mA or less.
- Other features: Auto-MDIX, so no crossover cables ever needed. Non-conductive enclosure for lab work. Will NOT route packets from TAP to Network ports.
6. Document findings, fix gaps, and retest
For each attempted flow, retain the source and destination, zones, service or protocol, timestamp, expected and observed results, enforcing rule, log or alert evidence, and any operational impact. Investigate unexpected successful connections promptly because they may create a path for lateral movement. Also investigate required business traffic that is blocked: unsafe workarounds can lead to broad exceptions that weaken the boundary.
After a policy or routing change, repeat the same scoped test and preserve the before-and-after evidence. Update the network diagram and flow matrix when the real design changes. NIST SP 800-115 covers analyzing findings and developing mitigations; CISA also recommends maintaining diagrams and monitoring network traffic.
How to assess different segmentation approaches
Where an environment uses more than one enforcement method, assess coverage and observability rather than relying on the product category or architecture label.
- Enforcement point: determine whether policy is applied by a network device, host or endpoint control, cloud control plane, or a combination.
- Visibility: establish whether the control sees routed flows only or can also use endpoint, identity, or application-workflow context. CISA’s July 29, 2025 microsegmentation announcement distinguishes network-based from endpoint-based approaches and notes that network-based controls can have more limited context.
- Alternate paths: verify that relevant interfaces, routes, remote-access paths, and third-party or cloud connections cross an enforced boundary.
- Monitoring: check that denied and suspicious cross-zone traffic is logged at relevant chokepoints and reviewed.
- Operational fit: confirm that the controls can be safely tested, changed, and maintained in the specific environment, particularly where OT or legacy systems are involved.
Safety limits and what the result means
Active discovery sends packets and may trigger security controls or affect older and weak systems. Use the approved test window, limited targets, agreed methods, and a stop contact. In OT environments, coordinate with operators and avoid activity that could affect safety or process availability. Passive capture can reduce probing, but it takes time and may miss hosts that do not communicate during the observation period.
Even well-tested segmentation is one layer of defense, not a guarantee that an intrusion cannot move. CISA’s #StopRansomware Guide warns that user error or failure to follow policy can undermine separation; a device or removable media bridging multiple segments, for example, can defeat the intended boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
