Bit-banging Ethernet On An ATTiny85

Ethernet bit banging

[Cnlohr] just published an ingenious but dangerous way to send Ethernet packets using an ATTiny85. The ATtiny directly drives one pair of differential TX wires of a standard Ethernet cable. Doing so will force the TX signal ground to be the same as the ATTiny’s and in some cases may put 48V on your AVR if your cable is plugged into a Power Over Ethernet switch… which may be a problem.

In the video embedded below [cnlhor] explains that the microcontroller is clocked at 20Mhz to bit-bang the Manchester encoded electrical signals. Using a neat trick his home switch will detect his platform as a 10MBit Ethernet switch which can then send hard-coded packets to his computer. As you can guess, each of this packets takes quite a bit of space inside the ATTiny’s flash memory: 2+Kbytes. All of the code used may be downloaded on the creator’s GitHub repository, though he constantly warned us that it shouldn’t be used for real life applications.

Edit: One of our readers also let us know of a similar awesome project called the IgorPlug-UDP. Make sure to check it out!

Comments

  1. ArchimedesPi says:

    That’s extremely clever! Kudos to [Cnlohr].

  2. arachnidster says:

    Nice hack, in the truest sense. Wouldn’t it work just as well with magnetics, though, with the added bonus of not blowing up your MCU?

    • Charles Lohr says:

      Yes. It would give better noise immunity, be substantially safer and prevent the AVR from going “pop” at the slightest sense of badness. All around, a wise choice.

      But then it wouldn’t be as ridiculous as a single-chip, no passives simplex 10Base-T adapter.

  3. Dodo says:

    Power over ethernet will only enable the power if your device can follow some turn-on procedure.

    Not using magnetics is not bad per se, the other side will still be galvanically isolated and as long as the cable run is not very long also induced common mode voltages will not damage the system. The biggest problem is that the signal will not be very balanced, turning the ethernet cable into an antenna.

    • RogFanther says:

      Well, actually not always. Many wireless access points, roubers / routerboards & etc just put thte power in the cable and send it away. Same to many homebrew solutions .

      But if he is just connected to the tx lines, the 48v ( or 24V, or 12V, 5v, etc ) voltages will not be connected to the uC, because the pins for PoE use the other, normally unused pairs.

      • Phrewfuf says:

        That is completely wrong.

        802.3af (max 15W PoE) and 802.3at (max 30W PoE) compliant PSUs will not send power unless the PD (Powered Device) requests so by completing the PoE handshake.
        Also i have never seen wireless accesspoints that could supply power. Doesn’t make sense for then to do anyways.

        Yes, there are exceptions, of course. For instance the PSUs (Switches) and PDs of Ubuquiti Networks aren’t 802.3af/at compliant, the PSUs can just apply power to the lines, causing you to fry anything that you connect if it’s not a ubiquiti PoE device. Yes, even a computer. Also you can set voltages on those (24V/48V) while 802.3af/at only specifies 48V.

        And of course cable usage is specified, too. With 10/100 NICs it’s fairly easy as those only use two pairs for data so the other two can be used for power. With Gbit-capable NICs it’s a whole other story, they need all four pairs for data. The power here is also applied to two pairs on the cable. The 2009 standard prohibits the use of all four pairs for power, though some manufacturers have build PoE devices that can do so and supply 50W.

        Consult this for more detail on phantom powering, PoE is pretty much the same concept: http://www.eevblog.com/2014/05/15/eevblog-616-how-microphone-phantom-powering-works/

        Source: large scale netadmin here.

    • Mike says:

      Not necessarily. The ‘standard’ for PoE isn’t always followed, and many cheaper devices just always put out 48V or whatever for the components regardless of whether they ask for it.

  4. Tobias says:

    Wow. This is seriously f***ed up. I love it :D

  5. ArchimedesPi says:

    Now can he fit a TCP stack on the ATtiny? ;)

    • Roger Wolff says:

      He can’t even send more than three different packets…..

      Now, given a packet, converting that to the code required to send that packet isn’t difficult. So what you COULD do is to use the self-programming ability to flash a new “send this packet” code somewhere in the flash and execute that to send that packet. The problem then becomes: after 10k or 100k different packets, your flash starts to fail….

      This of course is related to the fact that AVRs cannot execute code from RAM….

  6. rasz_pl says:

    it is so clever you would think someone has done it already, like 7 years or so ?

    http://www.cesko.host.sk/IgorPlugUDP/IgorPlug-UDP%20(AVR)_eng.htm

    http://home.arcor.de/borkenhagen/IgorplugUDP/

    not mentioning it is _not cool_, that goes for both cnlohr and the person writing this news

    • Charles Lohr says:

      HEY THAT IS COOL. I googled for a good bit, I don’t know how this didn’t come up! I guess I’m terrible at google.

      • Charles Lohr says:

        (P.S. Updated video to include that)

        • Nate B says:

          I’ve had the same thing happen. I thought my reset-on-LAN project was novel — couldn’t find anything related in a little searching, but I apparently didn’t use the right terms. After I published it, someone pointed out Whack-on-LAN, several years prior.

          Kudos where they’re due, but no malice ever intended!

      • Abhi says:

        I’ve not seen your page and video yet (I keep the better looking contents for devouring at end and start with comments first :) ) But there is an application note from (Intel I think) for using ethernet without phy. First thing I thought after reading that was it’d be great if someone does it for MCUs. (Yes I am toooooo lazy so always think what others can do, not me :D)

  7. rasz_pl says:

    moderation/spamfilter ate two of my my messages :/ so again:

    Yes, its so clever you would think someone already came up with this, like 7 years ago?

    IgorPlugUDP ? (cant link it, spamfilter doesnt like his domain name? WTF)

    seriously NOT COOL for not mentioning it, that goes for both had news man and cnlohr

    • neat, thanks!

    • Hey rasz. Found your message in the spam filter. Three pages back, just to give you an inkling of our spam volume.

      In defense of both CNLohr and Mathieu, the first link was last updated on 6.11.2004, or just barely after the first Hackaday post ever. No human could ever be aware of everything cool ever made, and this error of omission could hardly be called an error.

      • Charles Lohr says:

        I’m really glad you guys told me about this. His project is doing something immensely cleaver… Using a multitude of registers, he can make custom UDP packets and still get away with sending them… It is incredibly clever that he was able to use the bits for the UDP packet for the CRC by logically xoring. I think I am gonna have to re-implement this in a much more modern AVR environment (and for the T85).

      • rasz_pl says:

        >No human could ever be aware of everything cool ever made

        I am! Hire me :P
        I just checked and Igorplug-udp was the first google result for ‘bitbanging ethernet’ until today (HaD took over first with this post) :)

        About the spam filter. I noticed it doesnt eat known good links (github/yt) so I suspect you have some sort of whitelist? It used to put all my posts with links in moderation queue so I thought you whitelist users after some amount of good comments (informative links etc).

  8. JRDM says:

    It’s impressive.

    What does it take to add the appropriate magnetics?

  9. chango says:

    Since we’re all getting hung up on the isolation, why not capacitively couple it? People do this with the original mbed when they don’t want to dig up a proper transformer or magjack.

  10. alfcoder says:

    and i think it is good if there is power on the tx lines, just place one zener diode to the vcc and two series resistors to the tx lines, and one small buffer capacitor to vcc and then you not even need to provide the power supply :)

  11. ejonesss says:

    even if it did not fry the electronics you could get a ground loop noise if connected to ac line ground

    or take and hold the phone off the hook if it is connected to a dsl system or cause the tv signal not to work if it is connected to cable modem or dish.

  12. tekkieneet says:

    Or buy Ethernet connector with built-in magnetics. They are pretty cheap from China.

    • Greenaum says:

      So this is just a proof of principle and nothing else? Unless perhaps he added a few to his own personal network which he’d tested and could handle it. But not intended to be general-purpose or of general utility?

      Would this work ok then (I’d guess yes) if he just wired the pins to one of the included-magnetics Ethernet sockets? Blasting out Ethernet like this regardless is still pretty clever.

      Also how (can?) does he recieve packets, or is that another MCU’s job?

    • tekkieneet says:

      It is a transmit only setup. To be able to receive, you have to synchronize to the external data stream, store the data in RAM etc. So you’ll need a lot more horse power at least a few times of the data rate so that you get enough CPU cycles for that. (V-USB needs 12MHz AVR to process 1.5Mbps)

      You’ll probably need some signal conditioning with analog circuits. By the time you have done that, might as well use a proper embedded Ethernet chip or a cheap SPI to Ethernet board.

  13. RoGeorge says:

    Igor was also the first guy ever that implemented USB on a non USB microcontroller. He used an AVR, and Atmel officially published his paper under their application notes.

  14. Chris C. says:

    There are other reasons besides POE that you might want isolation. I have been shocked by holding the end of an Ethernet cable in one hand, and touching a grounded chassis with the other. Connecting a meter, I found the Ethernet wires capable of delivering ~90VAC while open, or ~3mA while grounded, both fluctuating over time. I’m certain no POE was present.

    The cable was run through the attic, and I suspected it was directly parallel to an AC line, picking up energy inductively. Seemed like a lot of energy to be accounted for by inductive coupling, but it wasn’t my job to further diagnose it.

    A few years later, I heard they found the electrical system had some “ground loop” issues, that required some serious rewiring to correct. Which probably wasn’t limited to actual grounds. The building is powered by three pole transformers, and I bet some of the hot or neutral lines from different transformers were erroneously interconnected. Which could have created unbalanced magnetic fields surrounding AC lines, leading to the unexpectedly high induced energy on that Ethernet cable…

    You never know when weirdness like this might be present. Switching power regulators have some weirdness as well, courtesy of capacitors interconnecting their otherwise isolated input and output, which can generate some spikes when initially connected. A better description than I can write is here:

    http://sound.westhost.com/articles/external-psu.htm#kil

    So I’d use magnetics, unless everything you’re connecting is literally on the same AC plug and power supply.

    • Mike Lu says:

      Some super cheap Ethernet “internet of things” devices like a Weatherdirect gadget I have don’t need an isolated Ethernet interface. The unit itself is completely encased in plastic and powered by a wall wart with its own isolation. I presume APs could use a similar setup, but only those with internal antennas.

    • tekkieneet says:

      It would work until both sides decided to not put a transformer and do some crazy stuff to their outputs. e.g. My VoIP ATA and my cordless phone base decided not to put in transformers as they both assume that the other side is “isolated”. Because of that, one of the power supply has to be isolated from the other or I would get a huge hum coming from the phone.
      In some rare cases, 2 switch mode supplies that doesn’t connect the output ground to Earth ground could have “leakage” high frequency AC current flowing between their ground.

  15. sebawetzel says:

    It would be more helpful if he used an atmega328 (sorry for my painful english)

  16. qwerty says:

    This has been done before and the same concept can be applied to a lot of interfaces at PHY level including USB, CAN etc. Given a mcu with the needed horsepower and a bunch of parts, many specialized ICs can be replicated.
    Now besides ground isolation and PoE there is one more reason you want magnetics on board: ESD protection. Properly designed ethernet interfaces employ ESD protection circuitry, a small microcontroller does not; if you run a long line in the wrong environment having a twisted pair for common mode noise rejection won’t help and soon you kiss the MCU goodbye.
    What follows is one easy way to implement basic ESD protection (*) but be aware that like every solution that doesn’t employ proper galvanic isolation (read: magnetics) it won’t like PoE injection at all.

    (*) Use mid power schottky diodes, not 1n4148s!

    • tekkieneet says:

      Not sure if you want the extra parasitic capacitance associated with a “mid power” schottky on a 10Mbps line.

      FYI: MBRS140 40V 1A schottky diode has 100pF to 300pF of capacitance in that configuration. (reverse bias 0V – 5V)

  17. marcus says:

    wow ..very interesting post…

  18. Whatnot says:

    Right, this is obviously a tutorial thing into the world of ethernet and not a practical thing to actually be using for real. Unless you are a supervillain and have a timer send a special packet on a tiny hidden device at some root hub or the pentagon that will initiate the end of the world.
    Or maybe on a plane’s internal network that will initiate the release of a compound that will destroy the world somehow. But that’s more a CIA thing to do.

    • Abhi says:

      Sorry to differ, but I believe its very useful (practical thing.) Consider a hidden bug sending lower bitrate audio (codec2/AMBE etc) consealed in securing plug etc sending audio continuously from a corporate office. Or for less adventurous souls, a small MCU attached to your router with another wireless MCU (C1000s etc) able to send information from various sensors in your home which you can read on your mobile anywhere, accessing a secure webpage or alerting you as soon as main door latch in your home opens (without spending fortunes on home security systems)

  19. Are you folks aware that Igor’s pages, his home page, is returning a 503 error? It’s been like that since when this example went live.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 93,618 other followers