Skip to main content
Crypto Miners Direct

Commercial guide

Mining Farm Networking and Monitoring

Plan the network for tens to thousands of ASIC miners and set up the monitoring, alerts and records that keep every unit connected and hashing.

Last reviewed October 5, 2026 by James Emerson

A mining farm network has one job: keep every miner connected to its pool while nothing outside can reach the machines. Miners need little bandwidth but a stable wired link, so the design effort goes into addressing, segmentation, redundancy and monitoring rather than speed. The build sequence and item list are in How to Build a Bitcoin Mining Farm and the equipment checklist.

Key points

  • Give each container or row its own subnet, and map every address to a physical position.
  • Isolate miners on their own segment, allowed out only to the pool, DNS and time servers, and never reachable from the internet.
  • Fill every pool entry, with the last one at a different pool.
  • Change the factory login on every unit, and load firmware only from the manufacturer's site.
  • Alert on departures from each unit's baseline and on any pool or worker change you did not make.

What a miner needs from the network

  • Wired Ethernet. Bitmain publishes an RJ45 Ethernet 10/100M port for the Antminer S21, and its S19-series setup guides say PoE is not supported.
  • Outbound access to the pool on the hostnames and ports it publishes. Braiins Pool, for example, documents ports 3333 and 443. Bitmain notes that if a network operator blocks the pool's port, miners get an address but cannot mine.
  • DNS, because pool addresses are hostnames.
  • Time. MicroBT says WhatsMiner hashrate statistics depend on NTP time and recommends a local NTP server.
  • DHCP at first power-on: Bitmain's S19-series setup guide and MicroBT's WhatsMiner operation guide both give it as the default.

Size the uplink from traffic measured on a pilot block at full load, plus margin. Stability matters more than capacity: Bitmain attributes low working hashrate partly to network instability, packet loss and unstable pool connections, and does not recommend 4G links.

Address plan

Use a private range from RFC 1918 (10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16) and give each container, row or hall its own subnet with room to grow. A /24 has 256 addresses, 254 usable after the network and broadcast addresses, 253 after the gateway.

An illustrative plan for one container of up to 220 slots:

Address Use
10.1.3.0/24 Site 1, container 3
.1 Gateway
.10 to .229 Miners at slot number + 9 (slot 1 = .10, slot 220 = .229), 220 addresses
.230 to .254 DHCP pool for new, reset or replaced units, 25 addresses

Reservations or static addresses. A DHCP reservation ties an address to the miner's MAC address on the server, so the plan lives in one place. A static address lives on the miner and survives a DHCP server failure. Either way, keep a dynamic pool on each subnet: a factory reset restores a unit's default settings, as does an S19-series Antminer firmware upgrade without "keep settings", and those defaults use DHCP. Keep fixed addresses outside the dynamic range; Bitmain lists a clash between a DHCP-assigned and a statically configured miner as a cause of lost access.

Locating units. Bitmain's IP Reporter has a "Shelf, Step, Position" mode: press the IP Report button on the control board and the address appears against a location. MicroBT's WhatsMinerTool does the same with the IP Found button, recording room, shelf, layer and place. Name pool workers by position too, for example account.c03s117 for container 3, slot 117.

Segmentation and firewall

Split the network into zones, usually VLANs (virtual LANs, isolated segments on shared switches), with a firewall between them.

Zone Contains Allowed traffic
Miners Miners only Out to pool hosts and ports, DNS, NTP. In only from management
Management Monitoring server, PDUs, sensors, cooling controllers, cameras, switch management Reaches miners and devices. Remote staff only through a VPN
Office and guest Staff PCs, phones, visitors Internet only. No route to miners

Bitmain reports farms where customers visited malicious websites and downloaded software that then infected miners, changed worker names and pointed them at pools the owners never joined. Its first response is to quarantine infected PCs and miners; zones contain that spread. Never forward a port from the internet to a miner.

Count ports, not speed; the S21's published port is 10/100 Mbit/s.

ports needed = miners + other networked devices + spare (your choice)

Illustrative: 200 miners and 6 other devices with 10% spare is 206 × 1.1 = 226.6, so 227 ports. With 48-port access switches, 227 ÷ 48 = 4.73, so 5 switches (240 ports).

  • Wire access switches in a star to an aggregation switch, not a daisy chain where one failed link isolates everything behind it.
  • Enable loop protection, and keep a configured spare switch and configuration backups on site.
  • At remote sites, use two uplinks from different providers on physically separate routes, with automatic failover tested while the fleet runs.
  • Put switches, router and firewall on a UPS. Its circuit and earthing are work for a qualified electrician to local code, and battery installations need fire-safety review by a qualified professional.

Pool connectivity

Miners talk to pools over Stratum. The Stratum V2 specification describes V1 as JSON-based and lacking cryptographic authentication, which leaves jobs open to man-in-the-middle tampering. V2 is binary and uses authenticated encryption after a Noise-protocol handshake, mandatory to remote pools and optional on the local network. A mining proxy can aggregate many devices into one upstream connection, and translation proxies let V2 pools accept V1 firmware. V2 use depends on firmware and pool; Braiins Pool's V2 address carries its public key, which the mining software uses to verify the endpoint.

Antminers take three pool entries, used in order as each fails. Bitmain recommends your main pool in entries 1 and 2 and a different pool in entry 3, so miners stop only if both pools fail together.

Security

  1. Change the factory login on every unit before it mines, to a unique strong password. Bitmain's APminerTool changes passwords in batch.
  2. Keep management interfaces in the management zone, reachable remotely only through a VPN. Revoke access and change shared credentials when people leave.
  3. Load firmware only from the manufacturer's site, for your exact model. Bitmain says not to use firmware it did not provide, states that unauthorised firmware voids warranty, and publishes official firmware at shop.bitmain.com/support/download. Pilot updates first, as in ASIC Miner Maintenance.
  4. If a unit is compromised, isolate it, reset it, reload official firmware and change the password, as Bitmain sets out.

What to monitor

Fleet software polls each miner and raises alerts. Thresholds are your decision: derive them from each model's published tolerances and limits and each unit's baseline, then tune until false alarms are rare. Bitmain's S19-series status page shows chips per chain, hashrate per hashboard, inlet and outlet temperature, fans and pools. MicroBT's status page lists hashrate, fans, pool, hashboard temperature and power.

Per unit Alert when
Hashrate, several-hour average Below rated by more than your tolerance
Hashboards and chips A board or chips missing
Rejected and stale shares (pool side) Rising, or pool hashrate well below the miner's
Temperatures Nearing the model's limit, or rising against baseline at the same intake
Fan speeds A fan missing or far from its neighbours
Power Off expected draw, from the miner where reported or from PDU metering
Pool address and worker name Any change you did not make
Online state Offline longer than your threshold
Site level Alert when
Power per feeder and PDU Departing from the expected total. Phase imbalance goes to the electrician
Inlet air or coolant supply temperature Nearing the model's range
Uplinks Failover occurred, or loss or delay to the pool rising
DHCP pool and switch ports Pool nearly full; port errors or flapping
UPS On battery or failed self-test

If the uplink fails, alerts sent from site never arrive, so add an external check that alarms when the site stops reporting. Board and fan faults are covered in Hashboard Troubleshooting.

Operations routine

Inventory. One record per miner: serial number, model and hashrate version, MAC, IP, position, worker name, PDU circuit, firmware version and warranty start. Recorded MACs expose duplicates, which Bitmain documents as making two miners drop in and out. Update the record after any control board swap.

Change log. Record every firmware rollout, pool, firewall, switch and address change with date, person, reason and rollback.

Spares. A configured switch, patch leads and a spare router or firewall.

Interval Task
Daily Review alerts, offline units and units below baseline
Weekly Compare pool-side and miner-side hashrate
Quarterly Test uplink and pool failover. Audit firewall rules, VPN users and credentials. Reconcile inventory with what the network sees

Sources