To successfully execute an SSH connection to a headless Raspberry Pi, the logical command (ssh user@ip) is entirely dependent on a flawless physical layer. If your power delivery sags below the 4.63V brownout threshold or your Ethernet pairs are miswired, the SSH daemon will drop packets or the SoC will throttle and crash. Before you open your terminal, you must verify the physical wiring and network topology.

The Physical and Logical Topology for Headless SSH

Establishing an SSH session requires two parallel physical paths: the Power Delivery (PD) path and the Layer 2 Data path. Here is the node-by-node trace from the source to the Raspberry Pi 5 load.

Power Path Trace (Source to Load)

  1. AC Mains (120V/230V): Enters the official 27W USB-C Power Supply Unit (PSU).
  2. PSU Flyback Transformer: Steps down and isolates AC to 5.1V DC (the 0.1V overage compensates for cable voltage drop).
  3. USB-C Cable (VBUS/GND): Carries 5.1V DC. The CC1/CC2 pins negotiate the power role, confirming the 5A/5V sink capability.
  4. Pi 5 USB-C Receptacle: VBUS enters the board through pins A4, A9, B4, and B9.
  5. Power Path Control IC: Routes power through a reverse-current protection MOSFET.
  6. RENESAS DA9098 PMIC: Buck-converts the 5V rail into the specific core voltages (e.g., 0.8V for the BCM2712 SoC core, 3.3V for I/O).

Data Path Trace (Source to Load)

  1. Host PC NIC: Generates TCP SYN packet on port 22, encapsulated in an Ethernet frame.
  2. Cat6 Cable (T568B): Carries differential signals on Pair 2 (TX) and Pair 3 (RX).
  3. Network Switch/Router: Reads the destination MAC address and forwards the frame out the port connected to the Pi.
  4. Pi RJ45 Jack: Receives the signal and passes it through internal magnetics for galvanic isolation.
  5. MAC/PHY Controller: Decodes the physical layer pulses into digital bits, passing them via PCIe/AXI to the SoC to be processed by the sshd daemon.

Terminal Mapping and Pinout Specifications

When troubleshooting a failed SSH connection, you must know exactly which terminal is which on the physical device. The table below maps the critical power and data pins for the Raspberry Pi 4 and 5.

Connector Pin(s) Function Polarity / Signal Voltage / Spec
USB-C (Power) A4, A9, B4, B9 VBUS (Power In) Positive (+) 5.1V DC (Nominal)
USB-C (Power) A1, A12, B1, B12 GND (Return) Negative / Ground 0V Reference
USB-C (Power) A5, B5 CC1, CC2 Configuration Channel PD Negotiation (Pull-down)
RJ45 (Ethernet) 1, 2 Pair 2 (TX) Differential (+ / -) 1000BASE-T (Orange)
RJ45 (Ethernet) 3, 6 Pair 3 (RX) Differential (+ / -) 1000BASE-T (Green)
Ground Path Explicit Callout: The ground return path flows from the BCM2712 SoC ground planes, through the PMIC ground, out the USB-C receptacle ground pins (A1, A12, B1, B12), and back to the power supply's isolated DC return. Never rely on the USB-C metal shield for primary ground return; it is for EMI shielding and equipment grounding only.

Verifying the Physical Layer with a Multimeter

If your SSH client throws a Connection timed out or Network is unreachable error, verify the physical layer before blaming the software. Set your multimeter to DC Voltage and Continuity modes.

  1. Verify VBUS at the Source: With the Pi disconnected, probe the USB-C plug's VBUS and GND pins. You must read between 5.0V and 5.15V. If it reads 4.8V unloaded, the PSU is failing and will cause brownouts under the SSH handshake load.
  2. Verify Voltage at the Load (Pi Test Pads): Connect the power. On a Pi 4, probe TP1 (5V) and TP2 (GND). On a Pi 5, measure across the 5V and GND pins on the 40-pin GPIO header (Pin 2 and Pin 6). A reading below 4.9V indicates excessive voltage drop in the USB-C cable. Swap to a shorter, 20AWG or thicker cable.
  3. Verify Ethernet Continuity: Unplug the Ethernet cable. Set your meter to continuity. Probe Pin 1 on the RJ45 plug to Pin 1 on the opposite end. Repeat for 2, 3, and 6. If Pin 3 and 6 show an open circuit, your RX pair is broken, meaning the Pi can send SSH keepalives but cannot receive your keystrokes.
Safety Warning: Never probe the AC mains side of the Raspberry Pi power supply. Only measure the isolated low-voltage DC side. If you suspect a fault in the PSU enclosure, discard it; they are sealed and not user-serviceable.

Decoding Network Diagram Symbols

When reviewing headless deployment documentation or drawing your own lab topology, you will encounter standard network symbols. Understanding what these diagram symbols mean in this drawing context prevents logical routing errors:

  • Cloud Icon: Represents the WAN/Internet. For local SSH, your traffic should not traverse the cloud unless you are using a tunneling service like Tailscale or Cloudflare Tunnels.
  • Cylinder with Arrows: The Router/Gateway. This device handles DHCP. Your Pi will request its IP address from this node upon boot.
  • Square with an 'X' or multiple arrows: A Network Switch. This operates at Layer 2. If your Host PC and Pi are connected to the same switch, SSH traffic stays local and bypasses the router's NAT.
  • Rectangle with a Gear: The Raspberry Pi (Endpoint). In logical diagrams, a small lock icon next to it denotes the sshd service listening on TCP Port 22.

Once the physical layer is verified and the IP is assigned via DHCP, execute the connection from your host terminal:

ssh -i ~/.ssh/id_rsa pi@192.168.1.50

For persistent configurations, map the host and identity file in your OpenSSH config file to avoid typing the full command repeatedly.

Frequently Asked Questions

How to connect to Raspberry Pi using SSH without a monitor or keyboard?

To connect headlessly, you must pre-configure the Wi-Fi or rely on Ethernet, and enable the SSH daemon before the first boot. For Wi-Fi, create a wpa_supplicant.conf file (or use the Raspberry Pi Imager's advanced settings gear icon to inject credentials). To enable SSH, place an empty file named exactly ssh (no file extension) in the root of the boot partition. Upon boot, the Pi OS detects this file, enables the sshd service, and deletes the file. You can then find the Pi's IP via your router's DHCP lease table and connect via your host PC's terminal.

Why does my SSH connection time out even though the Pi is powered on?

A timeout indicates a Layer 2 or Layer 3 failure. First, verify the Pi actually booted by checking if the green ACT LED flashes irregularly (reading the SD card). If it's solid red or unlit, the Pi failed to POST due to a corrupted OS or power brownout. If it booted, ping the Pi's IP address. If the ping fails, your host PC and the Pi are on different subnets, or the Pi's Ethernet/Wi-Fi interface failed to pull a DHCP lease. Check your Raspberry Pi network configuration and ensure your router hasn't isolated the wireless and wired networks via AP Isolation.

How to connect to Raspberry Pi using SSH over a direct Ethernet cable?

If you don't have a router, you can plug an Ethernet cable directly from your PC's NIC to the Pi's RJ45 jack. Modern NICs support Auto-MDIX, so a standard patch cable works (no crossover cable needed). However, without a DHCP server, neither device will have an IP address. You must configure your PC's Ethernet adapter to 'Share Internet Connection' (Windows) or enable Internet Sharing (macOS), which spins up a local DHCP server. Alternatively, assign static link-local addresses (e.g., 169.254.x.x) to both interfaces and SSH into raspberrypi.local using mDNS.

What do the network topology symbols mean in a headless setup diagram?

In headless setup diagrams, a dotted line usually represents a wireless (Wi-Fi/BLE) connection, while a solid line represents a hardwired physical connection (Ethernet/USB). A cylinder represents the DHCP server (router) assigning the IP address required for the SSH handshake. A padlock symbol over the connection line indicates the traffic is encrypted via the SSH protocol (TCP Port 22), distinguishing it from unencrypted protocols like Telnet or HTTP.