https://incompliancemag.com/article/designing-ethernet-cable-ports-to-withstand-lightning-surges/

In summary, our two laboratory test surges are:

    Common mode surge:  2/10 us, 6 kV open-circuit voltage, 100 amp short-circuit current
    Differential surge:  2/10 us, 1 kV open-circuit voltage, 100 amp short-circuit current

These are fairly severe surges, but there is considerable evidence
that surges near these values actually do occur in the field. In
addition, Ethernet ports that can survive these test surges have been
shown to hold up very well in actual field conditions. As we will see,
it is not difficult or expensive to design an Ethernet port that will
survive these test surges.


Guidelines for Achieving Immunity to 6 kV Common Mode Surges

The best strategy for immunity to common mode surges is to have a
strong isolation barrier that simply blocks the surge current. It is
important that all elements of the isolation barrier be considered
together as a system. Following are some general guidelines:

    Do not place overvoltage protection components across the
    isolation barrier, or from the cable conductors to ground. Let the
    transformer itself serve as the first line of defense.
    Maintain air gap spacings of at least 4 mm in the board layout of
    the isolation barrier. The goal is to keep the barrier’s air
    breakdown voltage higher than 6 kV, so that the strength of the
    barrier is controlled by the transformer and Smith caps, not by
    the air gaps.  If the Ethernet jack includes shielding or built-in
    indicator LEDs, careful attention must be given to maintaining the
    4 mm air gap within the jack itself.
    Use Smith caps that can handle a 6 kV surge. For multilayer
    ceramic capacitors, sometimes the limiting factor is the
    construction of the dielectric, and sometimes it is simply the
    physical spacing of the electrodes at each end. Note that by
    placing two equal-value capacitors in series, it is possible to
    double the effective breakdown voltage, although the effective
    capacitance is cut in half. Often this approach can be less
    expensive than using a single capacitor that is physically large
    and rated at a very high voltage.
    Lastly, make sure that the transformer itself will withstand a 6
    kV surge across its isolation barrier.

As noted above, most off-the-shelf Ethernet transformers will actually
stand off surge voltages in the range of 4 kV to 8 kV, but there is
considerable variation among different vendors, and there is also
considerable unit-to-unit variation among parts from the same vendor.

If your goal is to have each and every unit of production withstand 6
kV common mode surges, you should purchase a transformer that is
explicitly specified by the manufacturer to withstand 6 kV
surges. However, if your product is extremely cost sensitive and all
you want to do is get the best possible surge tolerance at minimal
cost, focus your initial efforts on items 1) to 3) listed
above. Failures due to deficiencies in these areas are far more common
than transformer failures.