I looked at several designs and recomendations.
Why do TVS diodes sometimes connect before and behind transformer?
What are the pros and cons of connecting before or behind?
Interesting question.
In reality it probably does not matter much which side you put them on, however there are pros and cons to both.
Connector Side
PRO: As a general rule of thumb you want transient suppressors as close to the connector as you can so the voltage/current spike does not go very far on the PCB and has less chance to cross-couple into other, unprotected traces and devices via capacitive coupling. Being on the connector side, obviously fulfills this requirement.
CON 1: The suppressors are really there to protect your electronics. Beyond the transformer they are really not "directly" protecting much other than the transformer which probably does not care if there is a spike on the line.
CON 2: If a spike is sufficient to destroy the TVS diode to a short, you now have a shorted communication cable.
CON 3: There is some question about whether the TVS devices significantly changes the impedance of the line. This could impact the bandwidth of your system.
Driver Side
PRO: Here the device IS actually protecting your sensitive devices.
CON 1: The spike energy is dissipated in your side of the interface. This can result in transients propagated into the ground system of your PCB.
CON 2: Careful routing has to be established to ensure the lines from the connector through the transformer are isolated from other signals up the TVS point.
CON 3: It is possible that a sufficiently nasty spike can short the insulation in the transformer resulting in a significant reduction in functionality.
Summary
From the above, it would appear connector side is the better protection method, but driver side is less intrusive on the functionality of the line.
Most of the examples I am seeing show it on the phy side which makes sense from the standpoint of it is close to the device you are trying to protect and if you are using an RJ45 with integrated magnetics it is only place you can put it. I have never used a TVS for an Ethernet design and have never seen it used in any Ethernet reference design. The Ethernet transformer provides some amount protection against ESD. Some Ethernet phys have some level of built in ESD protection. You could always design the TVS in and not populate if they are not needed.
Just a word of warning from experience : If you have the protection diodes on the connector side (before the transformer) and your system has a floating ground, this can cause CRC errors and Ethernet dropout.
I believe the failure mechanism is due to the protection diodes momentarily becoming forward biased as the floating signal ground settles.
I would always fit the diodes on the PHY side.