Reverse engineering the M-series hardware reset

Ubiquiti has added a handy feature to the new M-series of their outdoor 802.11n gear: A way to reset the device to factory defaults via the ethernet jack. Remote reset is super handy when the unit is mounted way up in a tower and the only way to reach it is with a cherrypicker.

I'd like to be able to reset my hardware automatically for doing completely hands-free (re)provisioning, but for some reason Ubiquiti doesn't want to tell customers (that's me) how to use the remote reset feature, I even asked politely, but were told that the feature is undocumented.

I hate to have paid for features that I can't use, so I cracked open a Bullet M5 that I had lying around to have a look at the mysterious reset circuit, this is what I found:

The big coily mess is an ethernet transformer with a common center-tap for the TX and RX wire pairs, the datasheet is here: mtek-h16125mcg.pdf [172K].

The transistor is a small-signal NPN marked W1A, which probably means it's an PMBT3904

There's a zener diode that measures to be about 15V.

Bottom line is that to press the reset button on the M-series hardware remotely all you need to do is to put +15 to +24V on the center tap of the ethernet transformer at the remote end, with respect to the power supply ground. I haven't tried it but it ought to be possible to simply put + on any one of the 4 wires.

I've taken a stack of photos and scans of the Bullet M5 and POE-24 guts.

© Flemming Frandsen - Worst viewed with MSIE, because it sucks. - Firefox is ok though. - stopsoftwarepatents.eu petition banner