Hak5 Packet Squirrel POE Upgrade Mod

I'm not totally sure why POE was not included in Hak5's new Packet Squirrel. (EDIT: I am sure why now, there are just too many options and different configurations to deal with to make a single product that can cover them all. Hak5 did it perfectly. If you need to power your Packet Squirrel with POE I think the best option would be an external POE tap that has a USB port allowing you to hook it up like normal, something like this. This mod works but it is very situational, sooooo it WON'T work in all situations. Each situation would require a slightly different implementation of this mod.)

The FAQ says that it was left out due to a lack of space in striving to keep a small footprint. After taking a look under the nutshell I don't understand why they came to that conclusion. There is a lot of room between the two boards, between the through hole lead components on the bottom board and a nice piece of real estate between the RJ45 connectors. Maybe it was more of a time and or cost issue, maybe it will be included in the next iteration, the Packet Ray. (Get it, because of the electric ray, no not an eel it's a ray google it.) It also will not pass POE between it's two RJ45 connectors because the spare pairs (4/5 & 7/8) are not connected to each, they are left floating on both connectors. That means if you insert this in front of a POE device the device will no longer receive power from the source. I'm nuts about this little thing as is but let's go ahead and make it better just because!

In the video above you see the completed POE modification. To simulate a POE source I am applying 48 volts on pair 4/5 & 7/8 (blue & brown) to an ethernet cable that is unterminated on one end. The terminated end is plugged into the Packet Squirrel (either port) which powers it up. On the adjacent RJ45 connector I connect an old wireless access point with a short ethernet jumper which powers the access point. BOOM, electric nuts for networks!

To accomplish this upgrade/modification you will need to first bridge the spare pairs (4/5 blue & 7/8 brown) between the RJ45 connectors so that the Packet Squirrel will pass POE. Then you will need to tap into the 48 volts from those two pairs and feed it to a voltage regulator or DC-DC converter. According to the documentation this draw 120mA at 5V from the micro-b USB port, that appears to be inaccurate. In the images above you will see the current waveform at startup. During boot up, which takes approximately 35 seconds, it draws 170-230mA. During normal operation, it draws between 148-150mA, which is 30mA over the rated specification. Using a linear regulator to drop 48 volts down to 5 volts isn't a good idea so we are going to use a DC to DC step-down converter of the "buck" type. We will be using a module based on the MP1584 step-down converter. Although it's only rated for a maximum input of 28 volts, it has a high output current rating and a high efficiency with a light load. I think it will work just fine. There are other options but this is what I had on hand. (Update: after long running times this is still functioning and creates almost no heat.)

Step 1: Understanding POE

POE can be confusing at first and as with any standard, there are multiple iterations and combinations that don't help at all. But we don't need to concern ourselves with too much of the jargon because we are not turning the Packet Squirrel into a proper POE powered device. We are just tapping off the line, creating just a bit of a parasitic load. No one will miss those nuts, hopefully!

Terms Used:

PSE - Power Sourcing Equipment

Power sourcing equipment (PSE) such as injectors, hubs, switches, and routers provides power to powered devices.

PD - Powered Device

Powered Devices (PD) refer to network equipment such as IP cameras, WAPs, or VoIP phones that rely on power sourcing equipment to operate.

Since the Packet Squirrel already breaks the path between the spare pairs (4/5 & 7/8) meaning it breaks 1000Base-T signaling standards we are going to transparently bridge Mode B power between the RJ45 jacks and tap off about 0.825W from it (5V x 0.150A = 0.75W + 90% conversion efficiency = 0.825W). So the packet squirrel will not be a traditional PD, to the Mode B PSE, it is simply a part of the ethernet cable with a bit of a parasitic loss. Note: This will ONLY work behind a midspan POE injector which will break the path of pairs 4/5 & 7/8 between the switch and network device. If you use this method and directly attach to a switch it likely will not negotiate a connection properly due to the shorted spare pairs.

If you need your Packet Squirrel to function on a Mode A PSE then rather than tapping into the spare pairs on the RJ45 jacks you will need to connect the 48 volt jumpers feeding the DC-DC converter to the tap ports (pin 2 & 7) on the LAN side B1601S Base-T Magnetics Module (see attached data sheet) for pairs 1/2 & 3/6. If you need to pass Mode A power through the Packet Squirrel you should be able to connect pin 2 of each B1601S and pin 7 of each B1601S together but I have not tested this.

Jumpering the spare pairs between RJ45 connectors would fix 1000Base-T signaling but doing so would bypass the Packet Squirrel's ability to do its job since it can only negotiate 10/100Base-T on pairs 1/2 & 3/6, so that would be pointless.

Keep in mind that PDs are can be categorized into classes on the switch depending on their power requirements. In hopes, your Packet Squirrel will be perceived as a small voltage loss in the CAT cabling but if the port you are on is close to the maximum for its class level it may trigger an overcurrent error/alarm.

Class 0: .44 to 12.96 Watts

Class 1: .44 to 3.84 Watts

Class 2: 3.84 to 6.49 Watts

Class 3 6.49 to 12.95 Watts

If you want to get fancy or you just want* your Packet Squirrel to be a POE compliant PD you could add a POE controller in front of the DC-DC converter such as this one from On Semiconductor, or whatever suits your needs.

NCP1093, NCP1094 - Integrated IEEE 802.3at PoE-PD Interface Controller (See attached datasheet)

--

* I don't want the Packet Squirrel to be a compliant POE PD. It's already a covert man-in-the-middle device. Why would I want it to say, "Hey Mr. Network Switch, could I get some nuts please?" No, I want it to be a quite little parasitic squirrel drawing just enough power to get by while not interfering with the typical operation of whatever PD is on the target side.

Step 2: Gather the Parts

NOTICE: This project is level - I don't give a $%@# if I break my little squirrel. Proceed at your own risk!

BOM:

• Non-POE Packet Squirrel. :(
• DC-DC Buck Converter Step Down Module. eBoot's MP1584EN version on Amazon *
• A couple inches of 3/4" to 1" heat shrink tubing.
• About a foot of small AWG insulated wire. I use 28AWG Teflon coated.

Tools:

• Good soldering iron and small diameter solder.
• Desoldering iron and or copper desoldering braid.
• Cleaning solution to remove rosin, I use a solution of 95% denatured alcohol and 5% acetone.
• Small cleaning brush and paper towels.
• Hot glue gun.
• Heat gun or alternate heat source for heat shrink tubing.
• Box knife.
• Small flat metal screwdriver.
• Ceramic or plastic insulated adjustment screwdriver.
• Wire cutters and strippers.
• Helping hand and a small vice.
• Black sharpie.

*Keep in mind there are other options when choosing a DC-DC step-down converter, namely ones that are actually rated for 48 volts such as this one mEZD74800A-X but they cost more and are harder to find.

Step 3: Crack the Nut

First things first we've got to get that case off. Luckily Hak5 was kind enough not to glue the case or use some other irritating way of sealing it. It's only held together internally with 3 tabs and a 4th "sort of " tab next to the micro-b USB power port so that is where we are going to start since it is the weakest point.

Using a box knife or something similar, pry the case open next to the micro-b USB power port as seen in the photo.

Work your way around repeating this step on each corner.

Once all the corners are loosened remove the top of the case (the side with the LED).

Remove the plastic extension for the push button and the selector switch, paying attention to the orientation so you can put it back the same way.

To remove the board from the bottom half of the case hold onto the two RJ45 connectors and pull up as you push down on the case. The board will pivot up then just continue to lift up and it will pop right out.

Step 4: Add 5 Volt Power Injection Leads

We need to add leads to insert 5 volts directly into the board. Since the micro-b USB connector is out of reach we'll just use the VCC pin on the larger through-hole USB type A jack (the one for the flash drive).

Using the small AWG wire make 2 jumpers about 4" long, strip and tin both ends.

Solder the wires to pin 1 and pin 4 of the USB type A jack.

Mark the lead coming from pin 4 (side closest to the RJ45 jack) with a black sharpie to indicate the ground lead.

Give them a few twists to keep them together and route them past the micro-b USB power jack for now.

Step 5: Remove the Motherboard

Unfortunately, the spare pairs we need for POE are not connected to anything on the board so the only way to access them was to get to the back of the connector which is covered by the top motherboard. Despite this being a step I wanted to avoid it could have been much worse. The fact that they used a nice through-hole header on the bottom board to connect the top board made removal relatively easy.

There are many ways to desolder components. In this case, I simply added solder to the header, applied more heat with a broad tip soldering iron and then "gently" pry it loose from the bottom board.

The board is a high quality and I had no issues with pads detaching or ripping up traces.

The heat generated by this is also dissipated well in areas that aren't affected.

Step 6: Add POE Passthrough and 48 Volt Leads

We need to bridge the spare pairs 4/5 & 7/8 (blue & brown) between the two RJ45 connectors so that the Packet Squirrel will pass POE. Then we need to tap into those pairs to provide 48 volts to our DC-DC down converter.

Using a soldering iron with a fine point tip bridge pin 4 to pin 5 and pin 7 to pin 8 with a small dab of solder on both RJ45 connectors near the base where they solder to the board.

Using the small AWG wire:

• Make 2 jumpers about 3/4" long with about 1/16" stripped on both ends and tin them.
• Make 2 jumpers about 4" long with both ends stripped and tined as well.

Twist one end of a 4" wire to the end of a 3/4" wire and solder them together, repeat for the other two wires.

Using the soldering iron with a fine point tip again, solder the wires starting with the ends that have the two jumpers soldered together to pairs 4/5 and 7/8 on one RJ45 connector. Just heat the tined wire while holding it to the solder blob on the pin pairs being careful not to bridge any other pins or pads.

Solder the other end of the small jumpers to pairs 4/5 and 7/8 on the other RJ45 connector. Be sure to join pair 4/5 to 4/5 and 7/8 to 7/8, don't cross them.

At this point, I recommend you use a multimeter to check continuity between all the jumpers we made to ensure they are going where they are intended and to check for shorts between pins on the RJ45 connectors.

Mark the long wire coming from pair 7/8 with a black sharpie to indicate ground.

Give them a few twists to keep them together and route them past the micro-b USB power jack for now.

Hot glue the wires down to the network transformer (chip between the RJ45 jacks) to keep them secure.

Step 7: Replace the Motherboard

Start by cleaning up the pins on the bottom of the motherboard. They need to be free of solder blobs so they can be inserted into the holes on the bottom board. You can do this with a soldering iron and desoldering braid or with a desoldering gun.

Remove any solder from the holes on the bottom board and clean the top side to remove rosin and any loose solder blobs.

Gently push the motherboard header into the holes on the bottom board until the plastic stopper on the header is flush with the bottom board. The header pins should be protruding on the other side about 1/32 of an inch.

Using a soldering iron with a fine point tip, solder the header pins being careful not to bridge any of them.

Clean the bottom of the board you just soldered to remove rosin and any loose solder blobs.

Connect power to the micro-b USB plug to ensure your Squirrel still has all it's nut and boots up. If not, well that sucks. Check for solder blobs, damaged traces, etc. I got it to work the first time so I know it's doable, and I was pretty rough on it.

Step 8: Connect the DC-DC Step-Down Converter

Solder the anode of a small rectifier diode (such as a 1N4001) to the positive side of the converter board's output. (I forgot to add this diode in the video. This is necessary to prevent 5 volts from bleeding back to the spare pairs.)

Solder the positive lead coming from the USB jack to the cathode of the diode and. Solder the lead we marked with the black sharpie (negative lead) to the negative (-) side of the converter board's output.

Solder the leads coming from the RJ45 jack to the converter board's input. Again ensure the lead we marked with the black sharpie is connected to the negative (-) side.

If you have the means to insert 48 volts into pairs 4/5 & 7/8 of an ethernet cable to simulate POE Mode B or have a midspan POE injector now would be a good time to test everything.

You should be able to inject POE into either port and the Packet Squirrel should pass POE to the adjacent RJ45 connector as well.

Congrats the hard part is over! Now we just need to wrap things up.

Step 9: Close the Nut Shell

Ensure the 4 wires are routed underneath the micro-b USB power jack then place the board in the bottom of the case starting with the side furthest from the USB power jack. Pivot the case down to seat it watching the wires to make sure they stay put.

You can place a small piece of tape over the wires to protect them from the USB jack's metal edges if you have a clearance issue.

Replace the push button plastic extender. There are two tabs that angle down, those rest in two square holes on the bottom case half. Ensure the button can be pushed and is not bound or blocked by inserting the extension incorrectly.

Replace the selector switch plastic extender. There is a notch on the top of the plastic piece, with this up slide the extender onto the selector switch and ensure that it cleanly straddles the case edge with it's two "fins". Ensure proper operation of the switch by sliding it back and forth.

Replace the top by lining up the tabs and edges. Once aligned squeeze the two halves together, they should snap quietly but firmly together.

Step 10: Protect the DC-DC Step-Down Converter

I wanted to put this module in the case but it was just a bit too big to fit without griding the case down or modifying it in some other way. Perhaps I'll make a smaller DC-DC Step-Down Converter or one with a board geometry that fits between the two boards of the Packet Squirrel. Another option would be to just 3D print a new case with a space allowance for the small converter board.

That being said for now we'll just mount the board on the outside with some heat shrink tubing and hot glue.

Cut a couple inches of heat shrink tubing and shrink it down, sealing both ends with needle nose pliers while it's still hot.

Route the wires and glue the converter to the case.

That's it! I hope you enjoyed this mod and the instructable. It took me a few hours to do this but that includes all the "discovery" time. I think I could do this in about 30 minutes knowing what we know now.

Step 11: Video of the Entire Mod Process

If you want further detail on a particular step or just want to watch the entire trial and error process of making this idea happen then check out this video.

Happy hacking!