Three ethernet devices on one cable?

[madires]

Exactly! One of the three systems would run as a network sniffer but only for one direction. For sniffing also the reverse direction the third system would need a second NIC, i.e. RX pair of NIC #1 conected to the first TP pair and RX of NIC #2 connected to the second TP pair.

Connect RX and TX pairs together and use half-duplex?

I'm not sure about that. A hub which also implies half duplex mode doesn't send the input received at a port at the same port out again. It just sends the input to all other ports except the one where the input comes from. So we might assume that connecting RX and TX isn't supported by 10/100BaseT. Seems I'm right, in IEEE 802.3-2002 Section 1 about the 10BaseT MAU there are clear statements that a point-to-point connection is supported only between two MAUs, and if more than two DTEs should be connected together a repeater is required. And if I got the description of the Collision Presence function for half duplex mode right, receiving any Manchester code on RX while sending on TX causes a collision. So the answer is: no.