To verify that network segmentation is blocking lateral movement, test specific permitted and prohibited connections across each important boundary from authorized, representative endpoints. Confirm both what happened to the connection and what the enforcing firewall, ACL, host policy, or other control recorded. A timeout alone does not prove that segmentation blocked traffic: the destination may be offline, the service may not be listening, or the test may not have taken the path you intended.
What counts as evidence that a boundary works?
A VLAN name, network diagram, or written rule is not proof that devices in separate zones are actually isolated. The relevant control must apply the intended policy to real traffic on the path between them. CISA guidance describes controls such as access control lists (ACLs), firewalls, stateful inspection, VLANs, and demilitarized zones (DMZs); the specific enforcement point depends on the network.
As an Amazon Associate I earn from qualifying purchases.
For each test, seek evidence from both sides of the question:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →- Connection evidence: Did the approved application or service work when it was supposed to, or fail when it was supposed to?
- Policy evidence: Did the intended enforcement point make the expected allow or deny decision, and did the relevant logs or monitoring show it?
A failed connection without matching policy evidence is inconclusive. Likewise, a deny log is not enough to establish that a business-required allowed flow still works.
#1 Best Overall
![Dualcomm10/100/1000Base-T Gigabit Ethernet Network TAP [ETAP-2003]](https://m.media-amazon.com/images/I/41BN4VAnktL._SL160_.jpg)
- Network Tap for use with 10/100/1000Base-T Ethernet link
- Reliable and high performance. Tested with maximum in-line cable length (200m) at full 1Gbps data throughput with no single packet loss
- Capable of being powered from a computer's USB port with built-in inrush current limiting circuit to prevent the computer from possible damages or disturbances by instantaneous current surge
- Compatible with Power-over-Ethernet (PoE)
- Probably the smallest portable GbE Network Tap available on the market
How to define the test before sending traffic
Get authorization and set operational limits
Obtain written approval from the network and system owners. Define the networks and hosts in scope, test window, approved techniques, contacts for escalation, data-handling expectations, and conditions that require testing to stop. NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment (September 2008), treats rules of engagement as part of test planning.
Keep the scope narrow enough to test the intended boundary without sweeping unrelated systems. For legacy, fragile, or operational technology (OT) equipment, do not run active scans unless the system owners and safety plan explicitly permit them.
Map zones and write down expected flows
Use a current network diagram and asset inventory to identify the source and destination zones, the boundary between them, and the control expected to enforce policy. Include relevant user devices, servers, management networks, DMZs, remote-access paths, cloud or third-party connections, and OT networks. CISA recommends diagrams that capture major networks, addressing, topology, dependencies, third parties, and cloud connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- (10/100/1G) Gigabit Bypass network tap / sniffer equivalent to port mirror on a switch.
- The two monitor/sniff ports are isolated from the network being monitored.
- Automatic bypass of device on power fail.
- Power-over-Ethernet (POE) pass-through. Rated at .75A max at 57vdc
- 5v power through USB3 port or 5v wall transformer (or both). ~500ma consumption.
For each test, record the source zone and test host, destination zone and host, exact service or protocol, expected result, enforcing control, and expected log or alert. Define the matrix from actual business requirements: do not treat a broad rule such as “allow any” or a generic port list as a universal policy. CISA’s OT/IT baseline describes denying cross-boundary connections unless they are explicitly allowed, and logging and monitoring those connections.
How to check controls and monitoring before testing
Inspect the control responsible for each boundary before generating test traffic. Depending on the environment, that may be a firewall, router ACL, cloud security group, host firewall, endpoint policy, or a combination.
- Verify that the intended policy is attached to the correct interface, zone, route, endpoint group, or policy scope.
- Look for broad allow rules, unexpected routes, alternate interfaces, shared management paths, and exceptions that could bypass the named boundary.
- Confirm that relevant deny logs and monitoring are enabled at the enforcement point and that someone can review them during the test.
- Identify which system’s timestamps and flow details will be used to match a test to its policy decision.
CISA recommends logging denied traffic and monitoring key network chokepoints, including those between segments. For ICS networks, its guidance also recommends establishing normal traffic baselines before alerting on unexpected activity.
Rank #3
- 40% smaller than standard LAN tap
- Same Throwing Star LAN tap function in a new streamlined design
- Simple device for passively monitoring ethernet based communications
- Updated, intuitive silkscreen and streamlined design
- Every device assembled by hand in the USA with individual inspection and testing
How to test permitted and prohibited connections
- Choose an approved source and destination. Use representative endpoints in the zones identified in the matrix. Repeat from more than one source when routes, host policies, or user and device identities differ.
- Attempt only the specified service or protocol. For a flow expected to be permitted, verify that the business function works and that traffic uses the intended path. For a flow expected to be blocked, attempt the agreed connection without broadening the test into an unapproved scan.
- Check the policy decision. Match the attempt to the relevant firewall, ACL, endpoint-policy, or other enforcement evidence. Confirm that a prohibited attempt was denied at the intended boundary and that the expected log or alert appeared.
- Test direction deliberately. If the policy is meant to constrain traffic in both directions, test both directions where authorized. Stateful firewalls and asymmetric routes can make behavior differ by direction.
- Record the result and any impact. Capture the test time and flow details, the observed connection result, the policy evidence, and any operational effect.
Relevant pathways vary by environment. Where remote services or administrative access are in scope, CISA’s 2022 advisory on state-sponsored Russian cyber actors targeting the energy sector describes lateral-movement methods involving services such as RDP, VNC, and administrative shares. Test only the services and paths that your approved flow matrix calls for.
Recommended Free Tools
How to interpret a failed connection
Do not count a timeout or unsuccessful client connection as proof of segmentation by itself. The destination might be powered off, unreachable for another reason, or not listening on the service being tested. The probe may also have missed the relevant path.
To distinguish a boundary denial from those alternatives, establish through an approved control path or other authorized evidence that the destination is live and the service would respond. Then correlate the test timestamp and available flow details, such as the source, destination, protocol, and service, with the decision and logs at the enforcing control. If you cannot establish that the service was available or identify the policy decision, mark the result inconclusive rather than blocked.
NIST SP 800-115 notes that passive discovery can miss systems that do not communicate during the observation period, while active probing can be detected and may create problems on older or weak systems. A single negative observation therefore cannot establish the state of every host or path.
Rank #4
- Network Tap for use with 10/100Base-T link
- Capable of being powered from a computer's USB port with built-in inrush current limiting circuit to prevent the computer from possible damages or disturbances by instantaneous current surge
- Compatible with PoE. PoE pass-through between two inline ports
- Can also be used as a portable 4-port 10/100 Ethernet switch
What to record, fix, and retest
Maintain one record for each tested flow. Include the source and destination hosts and zones, service or protocol, test time, expected and observed results, enforcing rule or policy, log or alert evidence, and any operational impact.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Investigate unexpected successful connections promptly: they may reveal a route across a boundary that policy was intended to block. Also investigate business-required traffic that fails. A blocked legitimate flow can prompt unsafe workarounds or broad exceptions that weaken isolation. After a change, rerun the same scoped test and preserve the before-and-after evidence. NIST SP 800-115 discusses analyzing findings and developing mitigations; CISA guidance emphasizes maintaining diagrams and monitoring network traffic.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the segmentation approach affects validation
When an environment uses more than one kind of segmentation control, check that the controls collectively cover the paths being tested. CISA’s July 29, 2025 microsegmentation guidance describes both network-based and endpoint-based approaches.
Best Value
- The SharkTap is a special purpose 10/100/1000Base-T ethernet device that allows you to 'tap into' an ethernet connection. It is intended to be used with the free Wireshark protocol analyzer or equivalent.
- Conventional switches route packets only to the intended destination port, reducing traffic but preventing a third port from seeing all packets. The SharkTap duplicates all packets to or from the Network ports to the TAP port.
- Supports 10, 100 and 1000Base-T, all ports. Power-Over-Ethernet (PoE) pass-through.
- Powered from a USB-B cable (included), draws 350mA or less.
- Other features: Auto-MDIX, so no crossover cables ever needed. Non-conductive enclosure for lab work. Will NOT route packets from TAP to Network ports.
- Enforcement location: Identify whether policy is enforced by network devices, endpoint controls, cloud control planes, or a combination.
- Context and visibility: Establish whether the control evaluates only routed traffic or also uses endpoint, identity, or application-workflow context. CISA notes that network-based controls may have more limited visibility into those details.
- Alternate paths: Check whether relevant interfaces, routes, remote-access connections, and third-party or cloud paths also pass through an enforced boundary.
- Operational maintainability: Confirm that the controls can be safely tested and changed for the systems they protect, especially in OT and legacy environments.
Safety limits and what segmentation cannot prove
Active discovery sends packets, can be noticed by security controls, and may cause problems on older or weak systems. In OT environments, coordinate with operators and avoid tests that could affect safety or process availability. Use the agreed test window, approved source systems, narrow targets, and stop contact. Passive monitoring reduces the need to probe, but it takes time and can miss hosts that are silent during the observation period.
Successful tests show how the tested flows behaved under the conditions observed; they do not prove that every possible route or future configuration is safe. Segmentation is one layer of defense, not a guarantee that an intrusion cannot move. CISA’s #StopRansomware Guide cautions that user error or failure to follow policy can undermine segmentation; for example, a device or removable media that bridges segments can defeat the intended separation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
