• welcome home

    welcome home - 2001-03-26

    How do you send the bin files once you configure them to the cable modem?  Do you use the console port to send them? 


    • Ronald A. McCormick

      Cable modem configuration files are downloaded to the modem via TFTP while the modem is booting.    It is supplied by the your cable provider.

    • Anonymous - 2001-03-29

      Another question, If I am to use my own binaries on my cable modem, do I simply need to upload them to the modem via TFTP? or do I need to run a TFTP server locally and point the modem's binary in that direction?


      • Cornel Ciocirlan

        You cannot send the file via the ethernet port. The modem will only try to download the file from the cable interface - eg from the provider.

        Moreover, even if you do manage to send it a file, you will probably won't be able to get the modem on-line. This is because the modem configuration file contains a HMAC-MD5 hash which is performed using a secret key that only the operator knows. When your modem tries to get online, this hash (known as CMTS MIC) is sent to the CMTS together with some important data and the CMTS re-calculates it. If you don't know the key - which you probably don't - you can't get the modem to register with the network.

        So, this program will only help you if you are the cable operator and want to create modem configuration file. Or, if you want to learn about how cable modems work. There is no way to make a cable modem register with the network if you don't have the key that the operator is using.


    • Ronald A. McCormick

      There is no way to send a new configuration file to an already running modem.  When a cable modem boots, it first scans the downstream frequecies to locate a downstream CMTS (Cable Modem Termination System) connection.  It then reads a UCD (upstream channel discriptor (sp?)) off of the downstream and attempts to acquire an upstream channel.  Once it syncs on the upstream, the modem sends a DHCP request out of the CATV interface.  In the response is the TFP server ip address and filename to download.  The modem then does the TFTP download via the CATV interface.   Are you an end user or a cable company looking to start a cable data service?  If end user, sorry, there isnt much use for this program except to see what a config file looks like.  No DOCSIS compliant cable modem will accept the configuration download from the ethernet side.

    • Anonymous - 2001-03-29

      So in conclusion, would I be incorrect to say that this program will not be of help in uncapping an end-user cable modem? Also, could you offer a different method?

    • Ronald A. McCormick

      Nope, you would be correct in that statement, It will be of no help in uncapping your bandwidth....

    • Johnathan Leppert

      That is not true.

      You CAN send a TFTP file locally to the modem and it involves tricking the modem into thinking taking the file in from the Ethernet interface instead of the CATV side.

      This is based on the fact cable modems function as a "dumb" bridge. That is, if you configure your Ethernet card to assume the IP address (use the IP as the gateway also) of the TFTP server, you can ping the modem while it is starting up and it will associate the IP with the Ethernet interface. When the DOCSIS software goes looking for a TFTP file, it will send the request based on the route table which now includes a the IP address of the TFTP server on the Ethernet interface.

      Your computer responds, and the modem downloads the file.

      I have done this many times. However, it isn't much use as you know because most providers these days are using shared-secret authentication which relies on MD5 hashes and would take years to break if you don't know the secret 'key'.

      My previous provider did not use shared secret so I was in fact able to get around 5 Mbps up and down, effectivly uncapping the modem. They must have found out, however, because my TFTP file no longer worked and on downloading theirs they had disabled both SNMP from the Ethernet interface and also started using shared secret authentication.

      The only way I could see to use your own file would to somehow hack the OS or DOCSIS firmware such that it would send the original key from the provider's file while using your own custom key. I imagine this would involve manipulating the REG-RSP messages.

      That method might be facilitated by getting a ROM image from the modem and then somehow tricking the modem into accepting a TFTP upgrade of a modified image.


Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks