Is there a difference between using tcpdump/wireshark on a non-compromised computer and an Ethernet tap between computer and switch port?