Why Ethernet Surge Protectors Are a Cybersecurity Essential for Industrial Networks

By Dustin Guttadauro, Product Line Manager - Telecom & Fiber, Infinite Electronics

Key Takeaway 

•   Ethernet surge protectors prevent more than equipment damage — an unprotected switch or firewall port damaged by a surge event can fail in a state that passes all traffic rather than applying its configured access policies, creating an unauthorized network access condition without any attacker action. 

•   Industrial Ethernet ports are uniquely vulnerable because they connect to cables that cross high-EMI environments, run to outdoor field devices, and pass between buildings with different ground reference potentials — all of which expose the copper conductor to transient voltages that standard office cabling never encounters. 

•   An inline Ethernet SPD (surge protective device) clamps surge voltages to a safe level and conducts the energy to ground through a dedicated ground lug — but only if that ground lug is properly bonded to earth. An improperly grounded protector provides no meaningful protection; grounding quality is the variable that determines whether an installation actually works. 

•   PoE compatibility is the most common SPD procurement error: a non-PoE or under-rated protector installed on a PoE-powered device (IP camera, wireless AP, industrial access point) blocks power delivery, which is functionally equivalent to a denial-of-service attack on that device.  

Why are industrial Ethernet ports more vulnerable to surge events than office Ethernet? 

An Ethernet port in a corporate office connects to a cable that runs inside a building, between controlled spaces, with other structured cabling. The cable never leaves the conditioned environment; its exposure to electrical hazards is minimal. 

An Ethernet port in an industrial environment connects to cables that may run through the same cable tray as 480V motor power feeds, exit the building to a remote RTU mounted on an outdoor structure, bridge between two buildings with independent electrical ground systems, or terminate at a field device installed in an area that sees regular lightning activity. The cable is a conductor in an electrically active environment, and it collects whatever electrical energy that the environment delivers. 

Three surge delivery paths in industrial networks 

1. Lightning — direct and induced: a direct strike on a building, antenna mast, or outdoor cable introduces kilovolts of transient energy onto any conductor connected to the strike point. An indirect strike nearby induces transient voltages on outdoor cable runs through electromagnetic coupling — the field from the lightning channel couple's energy onto the cable without physical contact. In both cases, the transient travels along the conductor to whatever is connected at the other end. 

2. Switching transients from industrial equipment: large motors, variable frequency drives (VFDs), power factor correction banks, and high-current switching equipment generate inductive transients when they start, stop, or switch states. These transients conduct power conductors and radiate electromagnetically onto nearby data cables, sharing the same cable tray. In a manufacturing environment with equipment cycling throughout a production shift, this is a continuous low-level exposure. A large motor start-up can generate a transient exceeding 1kV on nearby unprotected cables. 

3. Ground fault differentials: when a copper Ethernet cable connects two locations with different electrical ground potentials — different buildings, different electrical distribution panels, large facilities where ground potential varies across the site — the potential difference appears on the cable conductors. A ground fault event at either location creates a voltage differential that the cable delivers to connected equipment. This is a ground loop condition, and it can damage equipment even when the rest of the electrical environment is calm. 

 How does surge damage become a cybersecurity problem? 

Equipment of damage from surge events is the obvious consequence. The cybersecurity consequence is less obvious and less frequently discussed, but it's why surge protection belongs to an OT security program, not just an electrical maintenance program. 

Fail-open behavior after port damage 

Network switches and firewalls degrade gradually under repeated surge stress before they fail completely. During degraded operation, a switch port may drop packets intermittently, produce CRC errors, or — in the most security-relevant scenario — fail in a pass-through state rather than an off state. A firewall port in pass-through state is not applying its configured policies; it's forwarding all traffic. From the firewall management perspective, the port may still appear functional; from a traffic perspective, it has become a transparent bridge. 

This condition is rare but not hypothetical. Port damage from surge events severe enough to cause partial failure of the protection logic within the PHY (physical layer transceiver) chip has been documented in field investigations of industrial network incidents. The same event that should have triggered an alarm and prompted a repair instead created a silent network access bypass that persisted until the device was replaced. 

Network access exposure during repair downtime 

When a switch or gateway port is destroyed by a surge event, the repair process typically requires replacing the device, reconfiguring it from backup or documentation, and restoring it to service. During the period between failure and restoration, the devices that are connected through that port are offline, which in an OT environment may mean loss of SCADA visibility, loss of remote access capability, or loss of historian data continuity. 

The repair period is also a window where the hurried process of restoration may not apply all security configurations correctly, restore factory default credentials rather than site-specific ones, firewall rules not fully restored, and logging not reconfigured. Repair procedures under production pressure are where security configuration errors are most likely to occur and least likely to be caught. 

Power event correlation with security incidents 

In industrial environments with a history of unprotected Ethernet infrastructure, the network disruptions caused by surge events and the network disruptions caused by cyber incidents are symptomatically similar: devices going offline, communication losses, and unexplained connectivity changes. This ambiguity makes incident triage harder — every unexplained network event requires investigation to determine whether it's an electrical failure or a security incident. Eliminating electrical causes through proper surge protection reduces false-positive security investigations and lets security teams focus on genuine anomalies.  

How do industrial Ethernet surge protectors work? 

An Ethernet surge protector is an inline device installed between the field device at end of the cable and the network switch. Under normal operating conditions, it is electrically transparent — the data signal passes through with negligible insertion loss. When a surge event occurs and the voltage on the cable conductors exceeds the device's clamping threshold, the protection element conducts the excess energy to ground through the protector's ground lug. 

Three protection technologies are used in data line SPDs: 

• Transient Voltage Suppressor (TVS) diodes: solid-state devices that respond in picoseconds and clamp voltage precisely. TVS diodes have a lower energy capacity than MOVs but respond faster — important for protecting modern high-speed interface circuits. Most quality industrial Ethernet SPDs use TVS diodes or hybrid TVS/gas discharge designs. 
• Metal Oxide Varistors (MOVs): respond in nanoseconds and handle higher surge energy than TVS diodes but have a finite life — each surge event partially degrades the MOV. MOVs are used in AC power SPDs and in some data line applications where high energy capacity is the priority. 
• Gas Discharge Tubes (GDTs): handle the highest surge currents of any protection technology and have very low capacitance (important for high-frequency data signals) but respond more slowly than solid-state devices. GDTs are used in combination with TVS diodes in hybrid designs that combine fast response with high energy capacity — the GDT handles the bulk energy; the TVS diode clamps the residual voltage quickly. 

The clamping voltage — the voltage at which the device begins conducting — determines how much voltage reaches the connected equipment. A protector with a 50V clamping voltage on a port that tolerates 10V transients provides no protection. Most quality Ethernet SPDs clamp below 50V, well within the tolerance of the Ethernet PHY circuits they protect. 

Grounding is the mechanism that determines whether clamping actually works. The surge energy conducted by the protection element has to go somewhere. That somewhere is the ground lug. If the ground lug is connected to a low-impedance earth ground, the energy discharges safely. If the ground lug is disconnected, poorly bonded, or connected through a high-impedance path, the energy has no exit and appears as a voltage stress on both sides of the protector. 

What specifications matter when selecting an industrial Ethernet surge protector? 

The specification sheet for an Ethernet SPD contains several values that affect whether it's the right device for a specific installation. The table below defines each one and explains its selection of implications. 

The two specifications that most frequently because incorrect selections are PoE compatibility and surge current rating. A protector that doesn't pass PoE will disable power delivery to any PoE device connected downstream — the device goes offline as effectively as if the cable were cut. A protector rated for 10kA installed on a direct outdoor run where 40kA events are possible may be destroyed by a large surge event, leaving the port unprotected from subsequent events.  

How does PoE compatibility work with Ethernet surge protectors? 

Power over Ethernet (PoE) delivers DC power from a Power Sourcing Equipment (PSE) — typically a managed switch — to a Powered Device (PD) over the Ethernet cable. The power is delivered on the same conductors as the data signal, on DC voltages that range from 48V (PoE, 15W maximum) to 50–57V (PoE+, 30W; PoE++, 60W or 90W). 

An Ethernet surge protector installed between a PoE switch and a PoE device must pass both the data signal and the DC power. A protector designed only for data signal protection will either block the DC power (the PD doesn't power on) or degrade the power delivery enough that the PD operates unreliably. 

Three PoE ratings correspond to three power delivery levels: 

• PoE (IEEE 802.3af): 15.4W at the PSE, 13W minimum at the PD. Covers most basic IP cameras, access points, and VoIP phones. 
• PoE+ (IEEE 802.3at): 30W at the PSE, 25.5W minimum at the PD. Covers pan-tilt-zoom cameras, industrial Wi-Fi APs, and higher-power IP devices. 
• PoE++ (IEEE 802.3bt): 60W (Type 3) or 90W (Type 4) at the PSE. Covers high-power devices: small switches powered over the uplink, video conferencing equipment, and powered industrial gateways. 

When specifying a surge protector for a PoE application, verify the PoE class of the powered device before selecting the protector. Installing a PoE-rated protector on a PoE+ device will prevent the PD from receiving its full power budget, which may cause intermittent operation or failure to power on. Installing a non-PoE protector on any PoE application blocks power delivery entirely. 

Which Ethernet surge protector is right for your installation scenario? 

The table below matches seven common industrial installation scenarios to the appropriate SPD specification. Select the row that most closely matches your installation; verify the PoE column against your specific device's power class before finalizing the specification. 

All scenarios in this table are addressed by products in theL-com Ethernet surge protector range — available in RJ45 inline, panel-mount, DIN rail block, and outdoor weatherproof configurations, with and without PoE/PoE+ pass-through. Filter by PoE support and surge current rating for your scenario. 

Which standards govern industrial Ethernet surge protection? 

Two standards are most relevant to Ethernet SPD selection in industrial environments: 

IEC 61643-21 

IEC 61643-21 is the international standard for surge protective devices for telecommunications and signal networks. It defines test methods and requirements for SPDs installed on telecom, data, and signal lines — including Ethernet. It specifies the test waveforms (8/20 µs for current; 1.2/50 µs for voltage), the surge current ratings, and the clamping voltage requirements that a compliant device must meet. When specifying Ethernet SPDs for industrial installations, IEC 61643-21 compliance is the baseline — it tells you the device has been tested to defined surge parameters, not just specified to them. 

IEEE C62.41 Categories B and C 

IEEE C62.41 defines representative surge environments at different locations in a building's electrical system. Category B covers indoor locations — distribution panels, protected distribution systems, and typical industrial indoor environments. Category C covers outdoor and service entrance locations — direct outdoor exposure, incoming utility service, and outdoor substations. For Ethernet SPDs, Category B testing covers indoor industrial applications; Category C testing is the appropriate standard for SPDs installed at outdoor cable entry points and direct outdoor exposures. Not all SPDs are rated to both categories; outdoor applications require a C-rated device. 

IEEE 802.3bt (PoE standard) 

IEEE 802.3bt defines the electrical requirements for Power over Ethernet, including the four PoE types (Type 1 through Type 4) and their power delivery specifications. A PoE-compatible SPD must pass the DC power at the correct voltage and current without introducing excessive resistance (which would cause voltage drop and power delivery shortfall) or interfering with the PoE handshake protocol that negotiates power delivery between the PSE and PD. Verify that any SPD specified for PoE applications lists its PoE standard compliance by IEEE 802.3 type. 

 What are the installation best practices for industrial Ethernet surge protectors? 

Correct installation determines whether a surge protector actually protects. The most common installation failure is grounding — an improperly bonded ground lug renders the protector unable to conduct surge energy away from the protected equipment. The second most common failure is incorrect placement — a protector installed at the device end of a long outdoor cable run has already let the surge energy travel the full cable length before the protector encounters it. 

Ethernet Surge Protector Installation Checklist 

1. Install the Protector Near the Cable Entry Point: Mount the Ethernet surge protector as close as possible to the building or enclosure entry point rather than near the connected device. A shorter distance between the protector and the grounding point reduces the amount of surge energy that can reach the equipment. 

1. Use a Low-Impedance Ground Connection: Bond the protector's ground lug directly to the cabinet ground bus or building earth using a 6 AWG (or larger) grounding conductor. Keep the grounding wire as short and straight as possible to maximize surge protection effectiveness. 

1. Verify Ground Resistance Before Commissioning: Measure the resistance between the protector's ground lug and earth using a clamp meter or appropriate test equipment. The grounding path should have less than 1 ohm of resistance to ensure proper surge diversion. 

1. Confirm PoE Compatibility Before Installation: Verify the Power over Ethernet (PoE) class required by the connected device before selecting a surge protector. Using a protector with an incorrect PoE rating can prevent the device from receiving power. 

1. Separate Incoming and Outgoing Cables: Route the cable entering the surge protector separately from the cable leaving it. Avoid coiling excess cable near the protector, as closely routed cables can transfer surge energy through inductive coupling. 

1. Mount the Protector Inside a Locked Enclosure: Install the surge protector inside a secure, locked enclosure at the cable entry point rather than on an exposed DIN rail. This prevents unauthorized access or tampering with the protection device. 

1. Label Every Surge Protector: Clearly label each protector with the installation date, protected circuit identification, and the next scheduled inspection date to simplify maintenance and lifecycle management. 

1. Inspect Surge Protectors Annually: Perform a visual inspection at least once a year for burn marks, discoloration, corrosion, or physical damage. Replace any protector that has experienced a significant surge event, especially following a confirmed lightning strike. 

1. Document the Installation: Record the location, model, grounding point, and installation details of every surge protector in network infrastructure drawings and maintenance records to support compliance audits and future troubleshooting. 

1. Protect Both Ends of Outdoor Cable Runs: Install Ethernet surge protectors at both the outdoor device enclosure and the indoor building entry point. Protecting only one end allows surge energy to travel through the entire cable before it is diverted, leaving connected equipment vulnerable.  

The grounding note in the first row is worth emphasising: the ground conductor from the protector's ground lug to the cabinet ground bus should be as short as physically possible. Every metre of ground conductor adds inductance that limits the protector's ability to conduct high-frequency surge components to ground quickly. In outdoor installations where a dedicated ground rod is used, drive the rod as close to the enclosure as feasible and use 6 AWG copper minimum. 

How do you verify that an Ethernet surge protector is working? 

Surge protectors don't have status LEDs that confirm they're operational. Verification relies on checking the ground path and performing basic electrical tests before commissioning. 

• Ground resistance test: Use a low-resistance ohmmeter or earth ground tester to verify resistance between the protector's ground lug and the building earth ground. The result should be <1 ohm. Higher resistance indicates a poor bond or inadequate ground conductor; both conditions reduce surge protection effectiveness. This test should be performed at initial installation and annually thereafter. 
• Continuity verification: with the cable disconnected, verify that data passes correctly through the protector at operating speed. Significant insertion loss (>0.5dB) or inability to link at expected speed indicates a defective or damaged device. 
• Post-event inspection: after any confirmed lightning event in the area, visually inspect all surge protectors for burn marks, discolouration, or physical damage to the connector shells. A protector that has absorbed a significant surge may have degraded — TVS diodes and MOVs have finite energy absorption capacity and degrade after large events. Replace any protector showing physical signs of surge absorption. 
• PoE function verification: for PoE installations, verify that the powered device powers on and operates at full function after the protector is installed. Intermittent operation, failure to power on, or reduced PoE power class detected by the PSE all indicate PoE compatibility issues with the protector. 

Every unprotected industrial Ethernet port is a risk — electrical and security 

The cost of an inline Ethernet surge protector is a small fraction of the switch port, gateway, or field device it protects. The cost of a damaged port is the hardware replacement plus the production downtime during repair plus — in the worst case — the security exposure created by a port that fails in a pass-through state. That arithmetic works out clearly in favour of protection on every port connected to a cable that runs through an industrial environment. 

L-com'sEthernet surge protectors are available in inline RJ45, panel-mount, and DIN rail configurations, with PoE/PoE+/PoE++ pass-through options, rated to IEC 61643-21 and IEEE C62.41. Specify the protector before the cable is pulled — retrofitting surge protection after installation is possible but more expensive than including it in the original design. 

Frequently Asked Questions 

Q1: What does an Ethernet surge protector do? 

A: An Ethernet surge protector is an inline device that clamps transient voltages on Ethernet cable conductors to a safe level and conducts the excess energy to earth ground through a dedicated ground lug. Under normal operating conditions, the device is electrically transparent — data passes through with no meaningful signal degradation. When a surge event occurs (lightning induction, switching transient, ground fault), the protection element — typically a TVS diode, MOV, or hybrid combination — begins conducting when voltage exceeds the clamping threshold, diverting surge energy to ground before it reaches the connected switch or device.  

Q2: Do I need a surge protector on every Ethernet port? 

A: Not every port, but every port that connects to a cable at risk of surge exposure. The ports that need protection are those connecting to: outdoor cable runs or cables that pass through outdoor structures; cables that run near high-power industrial equipment (motors, VFDs, welding equipment, induction heaters); cables that cross between buildings with separate electrical grounds; and cables that connect to remote field devices in areas with lightning activity. Indoor-only cable runs in controlled environments where the cable never approaches electrical hazard sources have lower priority.  

Q3: What is the difference between a residential and an industrial Ethernet surge protector? 

A: Residential Ethernet surge protectors are designed for the surge environment of a home: the primary hazard is power line transients entering through service entrance connections, and the surge levels are moderate. Industrial Ethernet surge protectors are rated for higher surge currents (10–40 kA vs. 1–6kA for residential), wider operating temperatures, and the specific transient characteristics of industrial electrical environments — switching transients from large motors and VFDs that have different waveform characteristics than power line transients.   

Q4: How do I know if my Ethernet surge protector is still working? 

A: Ethernet surge protectors don't have self-test or status indicator functionality in most designs. Verification is done through periodic testing: an annual ground resistance test (<1 ohm from ground lug to earth) confirms the ground path is intact; a visual inspection checks for physical signs of surge absorption (burn marks, discolouration, damaged shells); and a post-event inspection after any confirmed lightning event in the area is recommended because protection elements degrade after absorbing large surges. 

Q5: Can Ethernet surge protectors affect network speed? 

A: A quality Ethernet surge protector introduces minimal signal degradation — typically less than 0.5dB of insertion loss and no reduction in link speed for 10/100/1000BASE-T applications. Some lower-quality devices or designs not optimised for high-frequency operation can introduce enough parasitic capacitance to degrade 1000BASE-T performance, particularly if multiple protectors are in series on a single cable run.