Want to physically disconnect Ethernet on/off - design recommendations needed - Page 1
Forum section: electronics / projects

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 01:59:04 pm
content: I am looking to build something I can plug ethernet into one side, and out of the other side, and be able to physically isolate it with a remote signal.Only need help on the piece that isisolatingdisconnecting the ethernet.Was thinking of using a few of these.http://www.semicon.toshiba.co.jp/info/docget.jsp?type=datasheet&lang=en&pid=TC7S66FAny reason it wouldn't work?Open to ideas. How is this done in a managed switch? Is there a better IC for this job?

author: c4757p
author_rank: Super Contributor
timestamp: June 01, 2015, 02:00:27 pm
content: So by 'isolate', you mean 'disconnect', right? Not like high voltage isolation?

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 02:06:17 pm
content: Quote from: c4757p on June 01, 2015, 02:00:27 pmCorrect.

author: free_electron
author_rank: Super Contributor
timestamp: June 01, 2015, 02:18:38 pm
content: dual pole relay ? simply cut the rx lines

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 02:18:56 pm
content: Nowhere near enough details to give a definitive response, but I would have very serious doubts whether two (or four, as needed) of those little things would adequately conduct even 10BASE-T, much less any higher speed, and certainly not POE. In particular there are issues of current capacity, and perhaps even more important are impedance and frequency response to maintain a network connection.Since we know nothing about the motivation here, we must ask why is such an unusual method required when there are more conventional methods of logically controlling an ethernet connection.Without any more details than you have offered, I would have to say it is extremely doubtful that will work reliably.

author: dom0
author_rank: Super Contributor
timestamp: June 01, 2015, 02:34:00 pm
content: Keystone panel on one side, piece of patch cable on the other with the latching tab removed. A servo / stepper motor inserts or removes the plug from the keystone panel when commanded to do so.

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 02:35:08 pm
content: Quote from: dom0 on June 01, 2015, 02:34:00 pmLOL.

author: Muttley Snickers
author_rank: Unknown
timestamp: June 01, 2015, 02:39:00 pm
content: You might try a separate switch or hub on that branch that you want to disconnect and use your rf relay to cut power to that switch or hub.Muttley

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 02:39:41 pm
content: Quote from: Richard Crowley on June 01, 2015, 02:18:56 pmJust looking for a way to electrically disconnect an ethernet (100base T) from an end user that can be controlled with a signal. I am looking at other solutions to my problem in parallel, but I wanted to see if this option was feasible.

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 02:41:15 pm
content: Quote from: Muttley Snickers on June 01, 2015, 02:39:00 pmYes, this is one of the options I am exploring, but ideally I would just have a single board that would have an Ethernet in and Out that I can electrically disconnect with a singal from my MCU.

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 02:45:28 pm
content: Quote from: jsquaredz on June 01, 2015, 02:39:41 pm100BASE-T is a quite sophisticated and precise design standard. It seems very doubtful that those little CMOS switches are up to the task of adequately passing the signal while maintaining the series resistance, impedance, and frequency response necessary to support 100BASE-T. You would be more likely to find success with a relay. Although any mechanical methods seem very crude in such a sophisticated design as a LAN connection.There may be even a dozen ways to "disconnect" a network connection LOGICALLY without any physical components. But since we don't see the big picture here we have no way of knowing which might be practical?

author: Muttley Snickers
author_rank: Unknown
timestamp: June 01, 2015, 02:48:07 pm
content: Sorry, but your first post said remote signal not remote command, silly me...

author: PeterFW
author_rank: Frequent Contributor
timestamp: June 01, 2015, 02:51:45 pm
content: Quote from: jsquaredz on June 01, 2015, 01:59:04 pmWith a relay, or multiple relays depending on the contacts.I horribly botched together cables and had not problems on 50 meters worth of unshieldet cable that i would not expect the relay to produce much of a problem.You only need four conductors annyway for 100Mbit, the other two pairs are not used.

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 02:58:34 pm
content: Quote from: PeterFW on June 01, 2015, 02:51:45 pmAny recommendations on a relay(s) for this? Needs to be pcb mounted.

author: SeanB
author_rank: Super Contributor
timestamp: June 01, 2015, 03:38:19 pm
content: 4 reed relays, either as 4 separate relays or as 4 reeds with a common coil wound around them all. Good isolation, and low capacitance and will not interfere much with the signal when on. Control will have to be either a separate port with some sort of network switch ( arduino with ethernet shield or a rasberry Pi using one of the GPIO lines) to switch on command.

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 04:10:09 pm
content: Quote from: jsquaredz on June 01, 2015, 02:58:34 pmYou will need TWO of these (or something like them)....4.5VDC DPDT SURFACE-MOUNT RELAY -- $1.25 eachhttp://www.allelectronics.com/make-a-store/item/rly-561/4.5vdc-dpdt-surface-mount-relay/1.htmlThey are cheap enough that you aren't wasting much $$ if they don't work.

author: jsquaredz
author_rank: Contributor
timestamp: June 01, 2015, 04:14:50 pm
content: Quote from: Richard Crowley on June 01, 2015, 04:10:09 pmLooks good. What contacts should I be breaking? Just the TX for each pair?

author: PeterFW
author_rank: Frequent Contributor
timestamp: June 01, 2015, 04:18:58 pm
content: Quote from: SeanB on June 01, 2015, 03:38:19 pmYes, a reed relay, not a "normal" one, would be my choice as well.They are sealed, compact and designed to run of 3-5V depending on the model.You get them in SMD or THT, along with a transistor, diode and resistor that is everything you need.Something like this:http://static.rapidonline.com/catalogueimages/Module/M029535P01WL.jpgYou can get them with very high specs as well in tiny, tiny packages, it all depends on were you buy them and how much you want to spend.

author: PeterFW
author_rank: Frequent Contributor
timestamp: June 01, 2015, 04:21:22 pm
content: Quote from: jsquaredz on June 01, 2015, 04:14:50 pmThat is not a sealed relay, at least it does not look like one.See my other reply.

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 04:45:34 pm
content: None of the other components (connectors, transformers, etc.) in the 100BASE-T circuit path are "sealed".It is not clear what is the motivation for a "sealed" relay?The TX is one pair (pin 1 & 2), and the RX is another pair (pin 3 & 6). They are differential/balanced signals.To make a complete break, you would interrupt BOTH pair.Although it would disrupt communication to break just one of the pair of wires for TX and for RX

author: DanielS
author_rank: Frequent Contributor
timestamp: June 01, 2015, 04:48:53 pm
content: If the intent is to disable a port for administrative reasons rather than electrical ones, I would simply use a managed switch and enable/disable the port through SNMP or the web-UI.

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 04:54:11 pm
content: Quote from: DanielS on June 01, 2015, 04:48:53 pmBut that is exactly what managed hubs are made to do. You can enable/disable ports over the network. No fooling around with extra hardware.

author: PeterFW
author_rank: Frequent Contributor
timestamp: June 01, 2015, 04:58:27 pm
content: Quote from: Richard Crowley on June 01, 2015, 04:45:34 pmBecause the signal does not carry that much power, not that much wetting current.He does not say were it will be used (hot, cold, dry, wet) how often/quick it will be switched.The additional cost is neglectable in this case since you get a contact surface that will stay much longer clean then a standard relay for just a bit more money and board space.Or in short: Way longer lifetime and less problems with contact wear/corosion.

author: agehall
author_rank: Frequent Contributor
timestamp: June 01, 2015, 05:04:16 pm
content: Quote from: Richard Crowley on June 01, 2015, 04:54:11 pmNot to be picky, but I don't think you can find a managed hub these days. Not even sure if there ever were managed hubs. I have not seen a hub in years...

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 05:09:19 pm
content: Quote from: agehall on June 01, 2015, 05:04:16 pmPerhaps we are now using managedswitches. Seems like a semantic distinction from this distance.But when I searched for managed hub on Ebay, I got a long list of available gadgets.Most of them cost far less than @DanielS will spend to cobble together his kludge.

author: bitwelder
author_rank: Super Contributor
timestamp: June 01, 2015, 05:18:09 pm
content: Why are you interested in having the connection *physically* isolated?You don't trust the 'administratively down' status of a switch port, or do you want to protect a device in case e.g. of a lightning that might hit the ethernet line, or what else?

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 05:44:29 pm
content: I participate in many different online forums, and this is a common scenario.Someone needs to do something and comes up with what seems like a plausible solution.Then they come to a forum like this and ask about the viability of their solution.But they never reveal what they are actually trying to accomplish, so we are left almost shooting in the dark.

author: PeterFW
author_rank: Frequent Contributor
timestamp: June 01, 2015, 05:52:38 pm
content: Quote from: Richard Crowley on June 01, 2015, 05:44:29 pmOf course the other common one is, over complicating things and assuming there is more and you know better.

author: eetech00
author_rank: Regular Contributor
timestamp: June 01, 2015, 07:56:32 pm
content: There are two ways of doing this:1. In order to logically "disable" the connection, the switch, or hub, needs to support SNMP commands that disable the port, or provide remote login capability to manually turn off the port. This capability is only provided by a managed device, and doesn't "physically" disconnect the port, it simply disables it via software.2. In order to phyically disconnect the port, there is a device called an "ethernet A/B switch". This is a specialized ethernet SPDT switch that "switches" ethernet connnections. The more sophisticated ones can be operated remotely and provide multiple "SPDT" switches. Google "ethernet A/B switch"..

author: nctnico
author_rank: Super Contributor
timestamp: June 01, 2015, 08:55:26 pm
content: I have the need for a similar function to disable ethernet to part of a network at certain hours of the day. I'm planning on simply powering a standard ethernet switch between the two network segments using a mains timer relay.

author: Richard Crowley
author_rank: Super Contributor
timestamp: June 01, 2015, 09:27:18 pm
content: Quote from: nctnico on June 01, 2015, 08:55:26 pmThere are many ways to accomplish that depending on exactly what "disable Ethernet" means.Some hubs/switches/firewalls/modems have "parental controls" where you can establish "operating hours" and it will automatically turn on and back off at the scheduled times. Or, if you are talking about only a limited number of computers, you could install a script that is scheduled to operate at the selected turn-on time and another for turn-off. And similar solutions that may or may not be appropriate based on many details not in evidence here.

author: eetech00
author_rank: Regular Contributor
timestamp: June 01, 2015, 09:52:39 pm
content: You might be able to use a switched PDU to provide automated/Timed power up/down. Checkout APC

author: Cliff Matthews
author_rank: Unknown
timestamp: June 01, 2015, 10:15:14 pm
content: Quote from: SeanB on June 01, 2015, 03:38:19 pmIf the op wants to PM me, I can donate 6 of these little 1" metal avionics reed relays (you only need 4 to interrupt the wt-og and wt-gr pairs). The coils are 500 ohms so you'll need 12v @ about 100ma (for all 4) that you can send down on the wt-bl or wt-br pairs.I think if you install them inline on the switch end, stagger them 2 inches apart keeping the twists in the cable as uninterrupted as possible (that way, you might get gigabit speed without issues).

author: nctnico
author_rank: Super Contributor
timestamp: June 02, 2015, 01:08:58 am
content: Quote from: Richard Crowley on June 01, 2015, 09:27:18 pmI need something which a 16 year old with part of my gene pool cannot hack...

author: TerraHertz
author_rank: Super Contributor
timestamp: June 02, 2015, 02:44:26 am
content: I'd recommend reed relays too. Ideally ones with mercury wetted contacts. A few ohms of contact resistance would ruin the impedance continuity of the cable. With attention to track layout and spacing of the switch reeds (two per pair, in common coil), it should be possible to achieve adequate impedance matching. 10/100 uses two pairs, while gigabit uses all four pairs (iirc.)Something like OP's idea has been on my wish list for a while as well. For two reasons: lightning voltage spike protection, and hostile intrusion protection.Re the lightning strike, it recently happened that a nearby strike killed 4 ethernet ports on various bits of equipment at my place. Annoying! The plan is to add some spark gap protectors to ground at the patch panel, plus physical isolation units at critical equipment. So I can disconnect critical stuff with one button press during close thunderstorms.As for hostile intrusion, the problem is that most (if not all) commercial networking gear seems to have intentional backdoors. Netgear and Cisco routers for instance. Given the revelations in Feb this year of 'Equation Group' malware (NSA, who else?) able to infect the firmware of hard drives, and that many drives turned out to be pre-infected from the manufacturers, it's no longer safe to assume *any* commercial hardware can be trusted.And so, there's an opportunity for an open source project to make an ethernet link 'monitor and isolate' unit. Like a router, only far more extreme. Undetectably monitor packets on a link against some user-specified rules, and if anything odd is seen, immediately physically disconnect the link. Powering down the mains to a switch could potentially act too slowly. Much better with the very short latency of small reed switches. Perhaps something even faster acting, such as FETs shorting out the pairs, would be a good idea too. You really want to stop all packets as soon as possible after any potentially hostile data is detected. Ideally, noticing something suspect in a header would kill the link before the rest of the packet passed.The reason to use physical switches is that the unit should not introduce any latency, unlike a switch, which does. For every possible test, it should look to the LAN exactly like a direct cable connection.Including spark-gap spike protection, with a screw terminal for direct connection to a ground stake, would be good too.The unit's command/status channel would be physically isolated from the monitored ethernet link. So there'd be an absolute assurance of zero possibility of influence from the monitored link.If someone could get these to market, with completely open-source code and design (hence verifyable trustability) and do it for an affordable price, they'd sell millions.Ref:http://everist.org/archives/links/__EquationGroup_info.txtSome other infamous malware names: Duqu, Flame, Gaus, Heartbleed, Regin, Stuxnet, Shellshock.

author: miguelvp
author_rank: Super Contributor
timestamp: June 02, 2015, 03:27:39 am
content: Quote from: nctnico on June 02, 2015, 01:08:58 amI used the parental control features and worked great on my Verizon FIOS hub router (Made by Actiontec) and I could specify when, so unless they could guess my password they would be SOL. Also you can change the WiFi password (not my idea but something I saw in youtube) to be communicated to them after the chores are done.I'll post an image in a bit of the scheduling features by device, btw they are all wrong now so no need to do this anymore.Edit: added image, not embedding it since it's a bit tall, also I blanked the devices in my home but it does show all of the devices currently connected

author: Cliff Matthews
author_rank: Unknown
timestamp: June 02, 2015, 03:47:12 am
content: To be sure just 2 pairs are required for 10, 100 and 1000 megabit/s Ethernet - they use only pins 1,2,3 and 6 of a RJ45 connector. The only time I have ever seen all 4 pairs in action are for 100baseTX (in the late 90's and it didn't last too long). FWIW, the blue pair always runs straight up the middle in most RJ series connectors and some telephone/PBX guys get nervous if they see it being used for data.Also for CAT5e and CAT6, there is such good isolation between pairs, that I have wired 2 PC's in back-to-back office cubicles on one cable. Granted, Y-splitting at both ends makes things look ugly.. (the Spanish say "chapucero" when they see this kind of work, but what do you do when you've run out of cable?).

author: Cliff Matthews
author_rank: Unknown
timestamp: June 02, 2015, 04:01:50 am
content: Quote from: miguelvp on June 02, 2015, 03:27:39 amParental controls are ok, but they usually work at the MAC and/or IP address level and believe it or not, on a PC those can be local administered on-the-fly. A solution offered by some routers is MAC filtering. You have a better chance at success if youdeny access to all by default, and enter a list of MAC's you will permit (both wired and wireless).It may be more work to admin a MAC restrictive network like this, but it is a home we're talking about.

author: miguelvp
author_rank: Super Contributor
timestamp: June 02, 2015, 04:04:43 am
content: In gaming, some people do cut the Ethernet wire via a switch to temporarily disconnect the network to produce lag for online games.This instructable takes it to an extreme but seems like it's on par of what the OP wants other than the remote methodhttp://www.instructables.com/id/Controller-Embedded-Remote-Lag-Switch/?ALLSTEPSQuote from: Cliff Matthews on June 02, 2015, 04:01:50 amYou can make rules for everything and add exclusions for well known machines.

author: Cliff Matthews
author_rank: Unknown
timestamp: June 02, 2015, 04:24:38 am
content: Quote from: miguelvp on June 02, 2015, 04:04:43 amSounds OK, I have an ASUS RT dual-core router that I use for my sons (2 pc's, 2 tablets, and 2 iphones = total 6 devices). Internet is off during meal times and off at night time and off for 2 hours for homework time after school but not on week-ends. Since 99% of routers use embedded Linux, that's a lot of hourly cron-job events inside the limited memory of many routers and not all is as printed on the box.https://www.youtube.com/v/IbsuvSjG0xMOne caveat: a month ago, my oldest son wanted me to add a 7th device to the list and quickly found it rebooting every hour.

author: bitwelder
author_rank: Super Contributor
timestamp: June 02, 2015, 05:04:59 am
content: Quote from: Richard Crowley on June 01, 2015, 05:44:29 pmI remember an episode at work, I was providing some IT support to my team and a developer came asking for a (parallel) printer cable. What? This was around 2005, and all our printers were either connected via network or USB.I asked him to show me what he wanted to do. Turns out, he was adding one more PC to an existing testing rig, and when it was about to connect it to the KVM switch, he saw the combined video+kbd+mouse DB25 connector and made his own conclusions

author: LabSpokane
author_rank: Super Contributor
timestamp: June 02, 2015, 05:07:10 am
content: Quote from: jsquaredz on June 01, 2015, 01:59:04 pmThese days a managed switch is pretty much one IC with some supporting components and a set of jacks with magnetics. The "disconnecting" is logical, not physical.What are you trying to accomplish? Air gapping for security reasons? Lightning protection? Other?

author: jwm_
author_rank: Frequent Contributor
timestamp: June 02, 2015, 05:17:57 am
content: Rather than disconnect the lines and introducing switches into the signal path, short the differential pairs to each other individually with relays or analog switches.You only need half as many switches and don't need to cut the signal path, just tap into them to short them.

author: Jeroen3
author_rank: Super Contributor
timestamp: June 02, 2015, 05:36:14 am
content: Buy an ethernet repeater or switch and a clock or domotics mains switch.You'll have 3000Vac isolation (twice normal 1500Vac), so that is a thousand times your original intended isolation voltage from your cmos switch. So you'll be fine.

author: matseng
author_rank: Frequent Contributor
timestamp: June 02, 2015, 05:42:34 am
content: Quote from: jwm_ on June 02, 2015, 05:17:57 am+1 to this.... No currents to speak of in the transformers and from what I remember from my networking training back in the days 10/100base-T is completely shortciruit proof.

author: nctnico
author_rank: Super Contributor
timestamp: June 02, 2015, 09:28:59 am
content: Quote from: miguelvp on June 02, 2015, 03:27:39 amI tried something similar. It worked for about 2 days.