Simple Ethernet killer switch. - Page 1
Forum section: electronics / projects

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 11:55:07 am
content: Hi,After many times that I plug/unplug the ethernet socket of my pc, I've decided to make a project for doing it directly from my desk, pressing a button or via a switch.I've also seen some other projects on the net, but many of them do not satisfy me: they plug the orange wire on a switch, but that's not what I'm looking for, because I would rather have something that is close to air gap. To make it short, i've decided to:1. use an octal buffer tri-state device like the Texas Instruments 54AC5412. a switch3. power the driver via ethernet: ethernet standard plugs can be used to power up the chip, as a result the device would be plug and play.Why I didn't opted for Arduino Instead? Well, considered this kind of application, using a microcontroller would be a waste. Relays costs a lot of money, and they also require a lot of current to work. and that's not their primary use.Since this is my first project with buffer tri-state, I've found that they can be configured to be used as switches, but when the chip works in the high impedence zone, would it be enough to stop traffic data?Is there any better solution?

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 12:03:24 pm
content: A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.

author: wraper
author_rank: Unknown
timestamp: June 25, 2016, 12:05:40 pm
content: Quote from: R005T3r on June 25, 2016, 11:55:07 amExcuse me, but how such IC has any chance to help you with your goal?Do you really need to unplug Ethernet at all?http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line

author: rs20
author_rank: Super Contributor
timestamp: June 25, 2016, 12:06:26 pm
content: Do you want to run at 10 Mbps? 100? 1 Gbps?Why is switching the orange wire not good enough? An off switchisan air gap.Your requirements only make sense if a hacker can hack into your ADSL modem and convince it to communicate on wires other than the orange wire. I suspect this is an unreasonable assumption, and easily tested.Have you considered shorting out the wires, rather than trying to open them? A switch on the line must actually carry the data. A switch across the lines just has to have a low enough off capacitance to not disturb the signal, a much easier task.Quote from: jtstowell on June 25, 2016, 12:03:24 pmForgot everything I said, this is an even better solution.

author: uncle_bob
author_rank: Unknown
timestamp: June 25, 2016, 12:28:33 pm
content: HiA lot depends on what you really are trying to do and why.There is no solid state device that is more reliable or more of an "air gap" than a toggle switch. The fewer parts in a system, the easier it is to make sure it all is correct (no sneak paths). If the purpose is positive verification that you are off the net, a switch is as close to a physical disconnect (unplug) as you will ever get. If you are dealing with nuclear missile launch codes, the toggle switch likely isn't adequate.If you have a modern computer and are concerned about intrusion, there a a *lot* of ways to get into most of them. As a minimum, some sort of faraday cage arrangement probably is called for to fully disconnect one. That will involve a lot more than a switch.If security is the issue, there are a lot of things you need to consider that are *much* higher up on the list than Ethernet disconnect.Bob

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 12:34:07 pm
content: Indeed. Absolute security is a bit of a pipe dream.As practitioners we aspire to "good enough."

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 02:40:48 pm
content: Quote from: jtstowell on June 25, 2016, 12:03:24 pmNah, not a good solution to me: I've already organized the stuff in a way that there's not a good way without re-arranging everything else, unless, there's a tiny 2 way switch, but I would probably need another plug on the wall...That is more than $20, if you count that I have to buy the switch and adding antoher plug. That's why I want it plug and play.Also, considered that I have pretty much anything other than the chip, that would be the cost of the chip only...

author: jeroen79
author_rank: Frequent Contributor
timestamp: June 25, 2016, 02:53:03 pm
content: What are you trying to achieve?Why are you plugging and unplugging your ethernetplug so many times?If you find switching one wire insufficient then you could just use a switch with more poles to switch whatever wire you wish.Or use a suitable relay if you want to do it remotely.

author: uncle_bob
author_rank: Unknown
timestamp: June 25, 2016, 02:53:51 pm
content: Quote from: R005T3r on June 25, 2016, 02:40:48 pmHiThe problem with the chip is that it is not going to work for what you want to do.Bob

author: Ian.M
author_rank: Super Contributor
timestamp: June 25, 2016, 03:01:43 pm
content: http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 03:06:16 pm
content: Quote from: wraper on June 25, 2016, 12:05:40 pmThis chip here has this design here:So, From I0 to I7 goes the ethernet in, to O 0-07 goes the output line. pin 1 and pin 19 are the control signals that open and closes the tri-states. What is really interesting about this IC is that actually all the eight tri-states are interconnected, as a result with a single toggle you can command all of them at once.

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 03:07:55 pm
content: Quote from: uncle_bob on June 25, 2016, 02:53:51 pmWhy?

author: MK14
author_rank: Super Contributor
timestamp: June 25, 2016, 03:15:31 pm
content: Quote from: R005T3r on June 25, 2016, 03:06:16 pmSo that chip will handle the 5 different voltages then ?(For clarity, I'm being sarcastic here)tl;drIt's a complicated very high frequency signal, which I doubt you can easily handle.

author: wraper
author_rank: Unknown
timestamp: June 25, 2016, 03:22:42 pm
content: Quote from: R005T3r on June 25, 2016, 03:06:16 pmBut why do you think cmos logic IC will work with ethernet signals?

author: bktemp
author_rank: Super Contributor
timestamp: June 25, 2016, 03:28:16 pm
content: You need an analogue switch, something like this one:https://www.fairchildsemi.com/products/analog-mixed-signal/switches/analog-switches/FSAL200.htmlOr much simpler: A small signal relay.

author: Delta
author_rank: Super Contributor
timestamp: June 25, 2016, 03:33:12 pm
content: Quote from: R005T3r on June 25, 2016, 03:07:55 pmEthernet is a differential signalling system using multiple voltage levels. That's why. Have you done any research at all?Just use a switch to short a pair or two if youreallyneed to do this...

author: uncle_bob
author_rank: Unknown
timestamp: June 25, 2016, 03:52:08 pm
content: Quote from: R005T3r on June 25, 2016, 03:07:55 pmHiIn addition to all that has been said above:1) They are floating AC signals and not referenced to a ground.2) You seem to be concerned about something that drives you to disconnect the Ethernet. Breaking the signals over to a grounded system messes up all sorts of RF things about them. That makes them easier to intercept and or piggyback on to.Yes there are more gotchas as well ...Bob

author: joeqsmith
author_rank: Super Contributor
timestamp: June 25, 2016, 03:55:13 pm
content: I am curious myself.Quote from: jeroen79 on June 25, 2016, 02:53:03 pm

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 05:18:20 pm
content: Ok guys.... Sorry I'm just a beginner in electronics, I was assuming by given that Ethernet signaling was the classical digital 1/0 V system, I've hadn't any idea that there were 5 different voltages... Now, the chart above, explains a lot of things, that I didn't knew.That said, the best solution is:Quote from: Ian.M on June 25, 2016, 03:01:43 pmDon't cost that much and so I don't have to mess up with Ethernet signaling and all that stuff...

author: Delta
author_rank: Super Contributor
timestamp: June 25, 2016, 05:28:53 pm
content: Quote from: R005T3r on June 25, 2016, 05:18:20 pmYeah, that's the way forward if you feel you need to do this mate.But NEVER assume anything. At least to a quick google or read the wiki article...

author: uncle_bob
author_rank: Unknown
timestamp: June 25, 2016, 05:31:25 pm
content: Quote from: R005T3r on June 25, 2016, 05:18:20 pmHiSince we still don't have the slightest idea what you actually are trying to do ... there still may be a lot of important gaps that are not being addressed.One possible gap:Are you running 10 megabit ethernet (as in 1970's speeds) or something much faster? (as in your computer is < 20 years old).Any time you mess with the wires in a ethernet cable, you create an impedance bump. That mismatch will degrade the signal to noise on the line and possibly introduce cross talk between the pairs. Put more simply - it adds a lot of noise. The switch you show may be fine for 10 megabit. It may be a disaster in some modern setups.Bob

author: Ian.M
author_rank: Super Contributor
timestamp: June 25, 2016, 05:44:10 pm
content: Chances are it will do 100 Megabit if the total cable length through it back to the 'hub' (actually active Ethernet switch) is a small fraction of the 100m permitted. I wouldn't expect it to work for Gigabit Ethernet. Its cheap enough to try anyway.As to why to use one to physically isolate the network? Well, if you frequently need to air-gap the PC, (e.g. when changing Antivirus or security programs) and both the back of the PC and the RJ45 wall socket are awkward to get at, or if the O.P. has a disability that makes unplugging/replugging a cable difficult, it makes sense to me.

author: joeqsmith
author_rank: Super Contributor
timestamp: June 25, 2016, 05:51:03 pm
content: Why not just disable the card from software? I was thinking they may be testing a new design and were looking for other problems with their stack design. Again, no clue. OP what's up? Just playing?Quote from: Ian.M on June 25, 2016, 05:44:10 pm

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 05:59:06 pm
content: Quote from: uncle_bob on June 25, 2016, 05:31:25 pmIt's a modern setup, made just 6 months ago. Gigabit ethernet cable consider that transfers are about 60-80MB/s....

author: Monkeh
author_rank: Super Contributor
timestamp: June 25, 2016, 06:03:21 pm
content: And just to chime in and ask the same question you've ignored numerous times now:Whydo you need to keep disconnecting it?

author: Jeroen3
author_rank: Super Contributor
timestamp: June 25, 2016, 06:28:40 pm
content: ClassicXY-problem, or is there something special in why you want to "unplug"?Are you writing device drivers? Or maybe an ethernet device?I'd guess not, you'd have known ethernet used differential signalling with transformers.Disabling the network adapter on any modern operating system works like this:Code: (Windows)netsh interface set interface name="Local Area Connection" admin=enablenetsh interface set interface name="Local Area Connection" admin=disableCode: (Linux)ifconfig eth0 upifconfig eth0 downThese should persist on reboot. Not recommended for servers.You'd need to be root to do this, obviously.

author: joeqsmith
author_rank: Super Contributor
timestamp: June 25, 2016, 06:41:30 pm
content: I was guessing they were a software type and had no clue about the hardware.Quote from: Jeroen3 on June 25, 2016, 06:28:40 pm

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 07:08:18 pm
content: There is also the other kind of ethernet killer. This one isn't mine, but I did wire up one of these at one point. It turned up recently.Never had the guts to try it out...

author: Jeroen3
author_rank: Super Contributor
timestamp: June 25, 2016, 07:10:34 pm
content: You could always use a power over ethernet insertion cable as shown above to permantenly disable your ethernet adapter.

author: Unknown
author_rank: Unknown
timestamp: June 25, 2016, 07:41:57 pm
content: Quote from: Monkeh on June 25, 2016, 06:03:21 pmIt's a secret the OP wants to take to his grave.

author: MK14
author_rank: Super Contributor
timestamp: June 25, 2016, 07:55:47 pm
content: Quote from: steverino on June 25, 2016, 07:41:57 pmIf I take the liberty of explaining WHY, despite me NOT being the OP.Disclaimer: Since I'm NOT the OP, I could be completely WRONG.I think he is worried about some of the rumored, backdoor(s) that are implemented in (some) Intel cpus. He is especially concerned that they may be activated at some point, and cause issues. Hence by keeping the PC air-gaped/isolated, most of the time, he believes it will protect him. There is also concerns about keyloggers and things.On pain of death, I will NOT ever reveal my source here (which was looking at his past posts, about his concerns about these issues).

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 09:16:49 pm
content: It's fascinating, as a thought experiment, to consider the ramifications of such things. Building a SCIF might be a fun hobby.

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 09:19:23 pm
content: Quote from: MK14 on June 25, 2016, 07:55:47 pmAnd, you are actually wrong. That's not why I keep disconnecting the eth plug: this regards only a special pc I have... I'm a bit keen on saying why, because it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 25, 2016, 09:27:39 pm
content: Quote from: jtstowell on June 25, 2016, 07:08:18 pmActually This device you have does not do any damage: Pc boards are optically insulated between parts, as a result it will only fry the controller if you are lucky. You have a better result with some coke poured on a pc board: after the thing dries it screw up everything because it conducts electricity.

author: Monkeh
author_rank: Super Contributor
timestamp: June 25, 2016, 09:28:44 pm
content: Quote from: R005T3r on June 25, 2016, 09:27:39 pmNo, they're not, and yes, it does.QuoteIf it gets through to the controller, you've got a good chance of being totally screwed, not just partially.

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 09:33:02 pm
content: Quote from: R005T3r on June 25, 2016, 09:27:39 pmI can't speak for all ethernet adapters across all time, but I have seen the results of a lightening strike that traveled via LAN wiring to destroy not only network adapters but also attached motherboards.

author: Monkeh
author_rank: Super Contributor
timestamp: June 25, 2016, 09:33:39 pm
content: Quote from: jtstowell on June 25, 2016, 09:33:02 pmLightning's a little more of an extreme. Okay, it's just a few million volts difference, but still.

author: jtstowell
author_rank: Contributor
timestamp: June 25, 2016, 09:38:45 pm
content: Quote from: Monkeh on June 25, 2016, 09:33:39 pm21 adapters were fried, along with 7 motherboards and one hub. Yes, hub. This was a while ago. For the record, it wasn't my idea to put the hub in the ceiling...

author: uncle_bob
author_rank: Unknown
timestamp: June 25, 2016, 10:22:14 pm
content: Quote from: R005T3r on June 25, 2016, 09:19:23 pmHiWith a proper security on a PC, it is essentially nothing on a network other than as an ARP entry. That's true if it is connected for 100 ms or for a few decades. Without a proper security the first time you connect ..... it does not matter that you disconnected it a few seconds later. Your trust in this switch approach is misplaced ....Bob

author: rs20
author_rank: Super Contributor
timestamp: June 26, 2016, 12:12:44 am
content: Quote from: R005T3r on June 25, 2016, 09:19:23 pmPr0n confirmed!

author: bitslice
author_rank: Frequent Contributor
timestamp: June 26, 2016, 12:41:30 am
content: Quote from: rs20 on June 26, 2016, 12:12:44 amPorn really should be kept on a shared drive, not an air gapped PC, that's just not polite.

author: Unknown
author_rank: Unknown
timestamp: June 26, 2016, 01:16:24 am
content: Quote from: rs20 on June 26, 2016, 12:12:44 amThat was my initial thought also, but I bit my tongue and didn't post. Sorry R005T3r, but secrets generate rumors...

author: BradC
author_rank: Super Contributor
timestamp: June 26, 2016, 01:51:38 am
content: Quote from: bitslice on June 26, 2016, 12:41:30 amIt's colloquially known as "the internet".

author: NiHaoMike
author_rank: Super Contributor
timestamp: June 26, 2016, 02:15:50 am
content: Or a PC being used to "test drive" Windows 10 with its built in "insecurity"? I don't see any reason keeping a porn PC offline so long as the content is legal. (In fact, just to mess with the "spies", have a Windows 10 PC dedicated to legal porn, always online, with an Arduino Leonardo semi randomly sending commands to play a video.)

author: uncle_bob
author_rank: Unknown
timestamp: June 26, 2016, 02:48:40 am
content: HiSo we all have had our fun and are completely sure that we know exactly what it going on. There is of course zero percent chance that it could be anything else. Nobody anywhere *ever* has a machine full of "borrowed" CAD software .... do they?Bob

author: bitwelder
author_rank: Super Contributor
timestamp: June 26, 2016, 07:46:19 am
content: Quote from: BradC on June 26, 2016, 01:51:38 amBonus points: you don't need to waste disk space in backups, you'll find others glad to do it for you.Regarding the 2-port network clunky-switch: any chance that it can cause damages to the connected devices (e.g. shorting wires while switching ports) ?

author: Ian.M
author_rank: Super Contributor
timestamp: June 26, 2016, 08:46:28 am
content: Quote from: bitwelder on June 26, 2016, 07:46:19 amProbably not - it would take a special level of incompetence to design one using make-before-break switches - and twisted pair Ethernet interfaces are fairly robust, typically tolerating shorts to other Ethernet signals without damage. I wouldn't want to use it with POE though!

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 26, 2016, 09:19:25 am
content: Quote from: steverino on June 26, 2016, 01:16:24 amAlright, I'll tell you why:No it's not p0rn-related. Actually I study malware and viruses and I collect them, see their effects on many different virtual machines, see what changes between OS and OS, Decompose the things and reverse engineer them(if I can). Actually When you see this:And after 2 minutes this:And that's on your real pc(or worse, it has spread all over your LAN)... Hmmm... Yes, you need to reinstall everything. That's why I need a toggle to disconnect your ethernet, because in some of these programs you can't really see the effects if you don't have Internet on. And, when it's cryptolocker is quite easy to get rid of: you just make backups (since you alredy know what you are dealing with) and you are fine, but when a boot-kit/root-kit break in your real pc or some adware spreads over your LAN, yes, you can imagine that's a real issue, so, even if it may happen, you can control your connections...DISCLAIMER: Even if I study these things, this don't mean I write them or decompose them in order to create more dangerous variations and stuff like that, because first it's illegal and second if the program goes into the wrong hands, well you potentially have court-nuclear warhead already launched against you...Also, that's why I posted That the "loudspeaker virus" is a hoax: never seen one before and loudspeakers are a bad way to communicate. There are way more efficient ways to spy or make harm...

author: Jeroen3
author_rank: Super Contributor
timestamp: June 26, 2016, 10:20:22 am
content: That is a legitimate reason to perform an unplug if you ask me.You can't trust the operating system in this case.There are a few things you should be aware of though:- you can also use routers to prevent access to other parts of the network. Only internet access can be router.- ISP's perform checks and quarantine procedures if they suspect you're spreading malware intentionally or unintentionally.

author: Delta
author_rank: Super Contributor
timestamp: June 26, 2016, 10:51:46 am
content: A-ha! So you are distributing your ransomware via porn sites eh? Very clever! That's why all 7 of my dedicated porn machines are all running Linux and behind a firewall.Everyone's got to make a living, good luck to you, I say!

author: madires
author_rank: Super Contributor
timestamp: June 26, 2016, 11:15:37 am
content: Since you're using VMs you could assign a VLAN to each virtual NIC instead of bridging it to the physical NIC of your host PC. Then setup your router/firefall for VLANs and isolate the networks, allow the VMs just to access the internet. That way you could also view the complete network traffic and/or log it (pcap) for analyzing it later on. Monitoring the network traffic gives you hints about how the malware communicates to control servers or tries to find other victims. Or you could place a victim VM into the same VLAN and watch what happens.

author: timb
author_rank: Super Contributor
timestamp: June 26, 2016, 12:53:36 pm
content: Quote from: madires on June 26, 2016, 11:15:37 amDing ding ding! We have a winner! This is the way to do it. What I would do is pickup a cheap 5-port managed or semi-managed (aka "smart") switch, which, in addition to allowing you setup VLANs would also allow you to implement port mirroring. That allows you to use a WireShark on a second machine to inspect the traffic on a much lower level. You can grab a 5-port semi-managed GigE switch on Amazon for ~$30 that do exactly that. (Assuming your existing router doesn't allow VLANs and mirroring.)

author: bitslice
author_rank: Frequent Contributor
timestamp: June 26, 2016, 01:05:29 pm
content: Router/firewall/switchs all may have their vulnerabilities, so I wouldn't rely on "hardware" to solve your security issue.Attacks on home ISP routers are well known, and the NSA had quietly hacked Cisco's gear years before anyone even considered the possibility.It's therefore not above a virus's capabilities to force its way through your network, even onto your GPU's bios

author: uncle_bob
author_rank: Unknown
timestamp: June 26, 2016, 01:30:15 pm
content: HiOk, I'd call that a legit reason to go for some sort of separation. My concern would then be for things like WiFi and Bluetooth that are a bit less easy to shut off. I have enough confidence in a managed switch (properly set up and used) that I would go that route rather than a physical switch. The whole VM thing has a few issues as well ...Bob

author: jtstowell
author_rank: Contributor
timestamp: June 26, 2016, 02:36:22 pm
content: It would also be pretty wise to route all traffic from your malware research lab through a VPN service, or perhaps tor. (i.e., do you like DDoS attacks? because that's how you get DDoS attacks...)

author: NiHaoMike
author_rank: Super Contributor
timestamp: June 26, 2016, 03:08:55 pm
content: Quote from: uncle_bob on June 26, 2016, 01:30:15 pmIf your "safe" machines are vulnerable to a compromised wireless device you own, they're also vulnerable to a "compromised" wireless device you do not own - i.e. one owned by an attacker.

author: joeqsmith
author_rank: Super Contributor
timestamp: June 27, 2016, 03:55:53 am
content: OP, thanks for clearing that up. I could see why you would not want to post that sort of info but it does make more sense now.I worked with a guy who collected code like this. One day I heard he had told someone that if something were to happen he would infect the companies LAN. Gone, right then and there.I didn't say he was all that bright.

author: hendorog
author_rank: Super Contributor
timestamp: June 27, 2016, 04:14:35 am
content: How about getting a small ethernet switch or router - one with a power button - and physically turning that off and on as needed?Put a big red e-stop switch in the power cord of the thing if you want it really obvious.That way its a physical thing, not a bit of software, and there is a physical action required to connect to the network.Edit: Doh I missed that this was already suggested early in the thread..

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 27, 2016, 09:03:39 am
content: Quote from: Delta on June 26, 2016, 10:51:46 amHAaha...Yes , exactly.I posted this thread as it can be used as evidence against me. You shouldn't be afraid of ransomware on linux: here there's a small list of what kind of threats there are out there:https://help.ubuntu.com/community/Linuxvirushttp://www.chkrootkit.org/That is only a small fraction of the threats available on windows (you know there's an entire encyclopedia dedicated to important viruses):http://virus.wikidot.com/http://www.trendmicro.com/vinfo/us/threat-encyclopedia/

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 27, 2016, 09:10:15 am
content: Quote from: uncle_bob on June 26, 2016, 01:30:15 pmNo the machine have no wifi, not any bluetooth... it's only a cpu + old hard drive + motherboard, 4Gb ram and a dvd drive...

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 27, 2016, 09:23:01 am
content: Quote from: joeqsmith on June 27, 2016, 03:55:53 amExactly, that's what I'm talking about. This is a really really dangerous rumor, because if your employer know this, you are the first to be blamed if something happens to them. Also, when the voices spreads, you are probably not able to get a work on an office again.

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 27, 2016, 10:03:09 am
content: Quote from: timb on June 26, 2016, 12:53:36 pmMy router allows VLANs.

author: bitseeker
author_rank: Super Contributor
timestamp: June 27, 2016, 10:34:26 pm
content: Thanks for clearing up the mystery, R005T3r. Security can be a double-edged sword and your motives easily misconstrued. But such research is an important and necessary thing.