Mr Radar Layer 1 Recon

The speaker, a physical penetration tester with a counter-surveillance background, starts from a close-access problem. When entering a building, an operator often cannot tell whether an empty wall jack leads to a switch. Plugging in a device blindly can waste a limited asset or trigger port security. Adversaries have used leave-behind devices on networks before, and common tools such as multimeters and off-the-shelf USB implants each have drawbacks.

The talk then covers Cat 5 basics at a simplified level. Balanced pairs terminate in transformer coils, so a small test voltage sent down a pair returns a measurable reading only when something is on the far end. Pairs used by 10/100 and gigabit links differ, and some devices can be recognized as 10/100-only from which pairs respond. The speaker describes earlier prototypes, including an Arduino-based ohmmeter, before arriving at Mr. Radar: a battery-powered microcontroller board that uses LEDs to report whether a switch is present, whether the link is likely 10/100-only, and which power over Ethernet mode is offered, all in under a second. Current-limiting resistors protect both the tool and the equipment. A live demonstration on a switch and a VoIP phone shows the expected light patterns.

The closing section lists open problems, including voltage readings that vary between switch vendors and the need for a larger sample to fingerprint devices at the end of a line. Planned work includes a single integrated board and a housing, and the project's hardware and firmware files are published. The practical takeaway is that a cheap, simple check can save equipment and reduce risk during physical access.