+- Haxorware Forums (http://www.haxorware.com/forums)
+-- Forum: General (http://www.haxorware.com/forums/forumdisplay.php?fid=6)
+--- Forum: Modems (http://www.haxorware.com/forums/forumdisplay.php?fid=7)
+--- Thread: Need Help With Docsis + Certs Please Guys (/showthread.php?tid=2044)
RE: Need Help With Docsis + Certs Please Guys - klonoa - 12-11-2012
(19-10-2012, 04:57 PM)ABMJR Wrote: M8,I don't see why you would need telnet into the modem for what you are describing.
In the past, the CM (cable modem) had the upper hand and could 'tell" the CMTS/UBR what to "offer" and allowed the CM to have access to the Network. This is no longer true. The only time the CM is able to take the upper hand is for a few seconds during the handshaking process while in TELNET. Once a few steps are done, this command is no longer useable, as you have passed that step during registration.
There is nothing , except for a command, to do now with the CMTS.
By the sound of that, it sounds like you could just put a clean walledgardend modem and then just simply unplug it and then load up a forced config by loading haxorwarelite onto it in the middle of the registration.
Or maybe the command you are looking for is to tell the CMTS to wait for the modem, to give it some more time so it doesn't timeout.
If it's like linux, something like wait and the time in ms. Though I am pretty new to the modem scene, so I have no idea if what I said makes sense.
RE: Need Help With Docsis + Certs Please Guys - mandrake77 - 12-11-2012
(12-11-2012, 02:07 AM)klonoa Wrote:(19-10-2012, 04:57 PM)ABMJR Wrote: M8,I don't see why you would need telnet into the modem for what you are describing.
In the past, the CM (cable modem) had the upper hand and could 'tell" the CMTS/UBR what to "offer" and allowed the CM to have access to the Network. This is no longer true. The only time the CM is able to take the upper hand is for a few seconds during the handshaking process while in TELNET. Once a few steps are done, this command is no longer useable, as you have passed that step during registration.
There is nothing , except for a command, to do now with the CMTS.
By the sound of that, it sounds like you could just put a clean walledgardend modem and then just simply unplug it and then load up a forced config by loading haxorwarelite onto it in the middle of the registration.
Or maybe the command you are looking for is to tell the CMTS to wait for the modem, to give it some more time so it doesn't timeout.
If it's like linux, something like wait and the time in ms. Though I am pretty new to the modem scene, so I have no idea if what I said makes sense.
Sounds like something that Ive tried in the past... but trying to force a cfg will just cause the cm to bootloop... Like in my case...
http://pastebin.com/X7BTK7Ae
Code:
Running the system...
Beginning Cable Modem operation...
0x00005a96 [Scan Downstream Thread] BcmVendorCmDownstreamScanThread::ThreadMain: (Scan Downstream Thread) Scanning for a Downstream Channel...
mot_scanList: Setting override freq @ 0
Favorite[0].freq = 699000000
Attempting Downstream FEC lock @ freq= 699000000 Hz, QAM64/256
CM> Found energy at frequency 699000000Hz! Publishing event kEventEnergyDetected...
0x00005ce4 [CmDocsisCtlThread] BcmCmDocsisCtlThread::StartUsInit: (CmDocsisCtlThread) Locked on the downstream. Waiting for UCDs...
******************************************
DOWNSTREAM STATUS
******************************************
Tuner Frequency = 699000000 Hz
Carrier Offset = 3 Hz
Symbol rate = 5360537 sym/sec
SNR = 37 dB
QAM Mode = QAM256
Tuner AGC = 0xfff00000
IF AGC = 0x13d184dd
Power Level = 6 dB
QAM = LOCKED
FEC = LOCKED
******************************************
CM> Selecting UCD for Us Channel 10
0x000065ea [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchDsTimeSync: (CmDocsisCtlThread) starting ds time sync acquisition...
0x0000687e [CmDocsisCtlThread] BcmCmDocsisCtlThread::SyncDsSyncOk: (CmDocsisCtlThread) downstream time sync acquired...
0x0000687e [CmDocsisCtlThread] BcmCmDocsisCtlThread::DsSyncOkResumeUsInit: (CmDocsisCtlThread) pre-REG upstream target case...starting initial ranging.
Beginning initial ranging...
Using stored initial upstream power = 45.0 dBmV
0x00006888 [CmDocsisCtlThread] BcmCmDocsisCtlThread::SyncDsSyncOk: (CmDocsisCtlThread) rx unexpected kDsSyncOk indication...
Not logging event ID 2307948724, control for level 7 is 0.
CM>
RNG-RSP Adj: tim=1460 power=-1 freq=0 Stat=Continue
CM> 0x00006c70 [DHCP Server Thread] BcmDhcpServerThread::ThreadMain: (DHCP Server Thread) Callback request expired:
timerDuration secs = 1
current time secs = 27
elapsed time secs = 1
CM>
RNG-RSP Adj: tim=0 power=-1 freq=0 Stat=Success
******************************************
UPSTREAM STATUS
******************************************
Upstream Status = UP
Upstream Channel = 10
Upstream Frequency = 25000000 Hz
Upstream Power = 44 dBmV
Ranging SID = 0x1cb1
Upstream Symbol Rate = 2560000 sym/sec
******************************************
Calculating maximum number of IP filters:
Each IP filter consumes 1880 bytes of RAM.
Current free RAM is 422456 bytes.
Max heap reserved for IP filters (25%) = 105614
We can support 56 IP filters.
Calculating maximum number of LLC filters:
Each LLC filter consumes 740 bytes of RAM.
Current free RAM is 422456 bytes.
Max heap reserved for LLC filters (25%) = 105614
We can support 142 LLC filters.
Starting IP Initialization with DHCP...
DHCPc: Waiting 1 seconds before sending Discover; client id htype=1, value=cm-001axxxxxx
Not logging event ID 2307948624, control for level 7 is 0.
CM> DHCPc: Sending Discover packet; client id htype=1, value=cm-001axxxxxx
DHCPc: Received an Offer from DHCP server 00:01:xx:xx:xx:xx (10.7.224.1); lease client id htype=1, value=cm-001axxxxxx
CM> DHCPc: Timed out waiting for offers for lease with client id htype=1, value=cm-001axxxxxx
DHCPc: Sending Request packet; client id htype=1, value=cm-001axxxxxx
DHCPc: Received an Ack from DHCP server 00:01:xx:xx:xx:xx (10.7.224.1); lease client id htype=1, value=cm-001axxxxxx
Current IP address is default 0.0.0.0.
0x00007b3e [DHCP Client Thread] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack1 HalIf)
Configuring IP stack 1:
IP Address = 10.7.224.242 (primary IP address)
Subnet Mask = 255.255.252.0
Router = 10.7.224.1
IsPrimaryInterface = 1
Logging event: DHCP WARNING - Non-critical field invalid in response.
ARPing for default GW IP = 10.7.224.1
MAC = 00:01:xx:xx:xx:xx
DHCP completed successfully!
DHCP Settings:
Client Id = htype=1, value=cm-001axxxxxx
State = Renewing (5)
Static Lease = 0
AutoConfig Mode = IP, Subnet and Router
XID = 0x1881227d
Number of Tries = 0
Max Discover Tries = 6
Max Request Tries = 6
DHCP server MAC addr = 00:01:xx:xx:xx:xx
Ignore NAKs = 0
My offered IP address = 10.7.224.242 (primary IP address)
(1) Subnet Mask = 255.255.252.0
(3) Router IP address = 10.7.224.1
(54) DHCP Server IP address = 192.168.10.10
(82) Relay Agent IP address = 10.7.224.1
TFTP Server IP address = 10.7.224.1
CM Configuration file = 'cm-001axxxxxx'
(2) UTC Time Offset = -18000 seconds
(4) Time Server IP address = 192.168.10.24
(6) Domain Name Server =
(7) Log Server IP address = 200.75.200.7
(51) Lease time = 3600 seconds
(58) T1 (renew) = 1800 seconds
(59) T2 (rebind) = 3150 seconds
Lease is infinite = 0
(122) PacketCable/CableHome -== SubOptions ==-
SubOpt(1) Primary Dhcp Server = 255.255.255.255
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=10.7.224.242, Subnet=255.255.252.0, Gateway=10.7.224.1
CmSnmpAgent::IpAddressAcquiredEvent for SB5102 CM Agent w/ BRCM Factory Support
IP addr = 10.7.224.242
Starting Time Of Day...
0x00007bde [CmDocsisIpThread] BcmDocsisTimeOfDayThread::SetTodServerIpAddress: (Time Of Day Thread) ToD servers: 192.168.10.24
Connecting to ToD server 192.168.10.24...
Sending UDP ToD request to server...
SNMP Agent Binding to 10.7.224.242:225
Not logging event ID 2291949724, control for level 7 is 0.
CM> UTC returned by ToD server 3561670628; UTC offset -18000
Current system time -> Sun Nov 11 19:57:08 2012
System start time -> Sun Nov 11 19:56:37 2012
Starting Tftp of configuration file...
Opening file 'cm-001axxxxxx' on 10.7.224.1 for reading...
tftp-enforce bypass is using 10.7.224.1:cm-001axxxxxx
Initiating fake TFTP Get (tftp-enforce bypass)
Bypass succeeded.File was 900 bytes
TFTPD Started
CM> Forcing Config TFTP IP to 127.0.0.1
Forcing Config File name to cm-xxxxxxxxxxxx
TFTPD received 1 from 10.7.224.242:1028
Storing received cfg of size 1168 to memory
TFTPD Shut down
Tftp read < 512 bytes, we have reached end of file.
Tftp transfer complete!
TFTP Settings:
Stack Interface = 1
Server Ip Address = 10.7.224.1
Server Port Number = 1029
Total Blocks Read = 3
Total Bytes Read = 1168
Config file was read! IP Initialization completed...
MAX CPE per CM is being set to 32
Time Of Day completed...
DefaultSnmpAgentClass::SystemTimeChangeEvent for SB5102 CM Agent w/ BRCM Factory Support
TLV-11[1]: 1.3.6.1.2.1.69.1.2.1.7.1 -> 4 (i32)
TLV-11[2]: 1.3.6.1.2.1.69.1.2.1.2.1 -> 192.168.10.21
TLV-11[3]: 1.3.6.1.2.1.69.1.2.1.3.1 -> 255.255.255.255
TLV-11[4]: 1.3.6.1.2.1.69.1.2.1.4.1 -> private
TLV-11[5]: 1.3.6.1.2.1.69.1.2.1.5.1 -> 3 (i32)
TLV-11[6]: 1.3.6.1.2.1.69.1.2.1.6.1 -> @
TLV-11[7]: 1.3.6.1.2.1.69.1.2.1.7.2 -> 4 (i32)
TLV-11[8]: 1.3.6.1.2.1.69.1.2.1.2.2 -> 192.168.10.0
TLV-11[9]: 1.3.6.1.2.1.69.1.2.1.3.2 -> 255.255.255.0
TLV-11[10]: 1.3.6.1.2.1.69.1.2.1.4.2 -> private
TLV-11[11]: 1.3.6.1.2.1.69.1.2.1.5.2 -> 3 (i32)
TLV-11[12]: 1.3.6.1.2.1.69.1.2.1.6.2 -> @
TLV-11[13]: 1.3.6.1.2.1.69.1.2.1.7.3 -> 4 (i32)
TLV-11[14]: 1.3.6.1.2.1.69.1.2.1.2.3 -> 200.75.200.26
TLV-11[15]: 1.3.6.1.2.1.69.1.2.1.3.3 -> 255.255.255.255
TLV-11[16]: 1.3.6.1.2.1.69.1.2.1.4.3 -> private
TLV-11[17]: 1.3.6.1.2.1.69.1.2.1.5.3 -> 3 (i32)
TLV-11[18]: 1.3.6.1.2.1.69.1.2.1.6.3 -> @
TLV-11[19]: 1.3.6.1.2.1.69.1.2.1.7.4 -> 4 (i32)
TLV-11[20]: 1.3.6.1.2.1.69.1.2.1.2.4 -> 192.168.129.128
TLV-11[21]: 1.3.6.1.2.1.69.1.2.1.3.4 -> 255.255.255.128
TLV-11[22]: 1.3.6.1.2.1.69.1.2.1.4.4 -> private
TLV-11[23]: 1.3.6.1.2.1.69.1.2.1.5.4 -> 3 (i32)
TLV-11[24]: 1.3.6.1.2.1.69.1.2.1.6.4 -> @
TLV-11[25]: 1.3.6.1.2.1.69.1.2.1.7.5 -> 4 (i32)
TLV-11[26]: 1.3.6.1.2.1.69.1.2.1.2.5 -> 192.168.129.128
TLV-11[27]: 1.3.6.1.2.1.69.1.2.1.3.5 -> 255.255.255.128
TLV-11[28]: 1.3.6.1.2.1.69.1.2.1.4.5 -> private
TLV-11[29]: 1.3.6.1.2.1.69.1.2.1.5.5 -> 3 (i32)
TLV-11[30]: 1.3.6.1.2.1.69.1.2.1.6.5 -> HEX:C7
TLV-11[31]: 1.3.6.1.2.1.69.1.2.1.7.6 -> 4 (i32)
TLV-11[32]: 1.3.6.1.2.1.69.1.2.1.2.6 -> 200.75.200.93
TLV-11[33]: 1.3.6.1.2.1.69.1.2.1.3.6 -> 255.255.255.255
TLV-11[34]: 1.3.6.1.2.1.69.1.2.1.4.6 -> private
TLV-11[35]: 1.3.6.1.2.1.69.1.2.1.5.6 -> 3 (i32)
TLV-11[36]: 1.3.6.1.2.1.69.1.2.1.6.6 -> @
TLV-11[37]: 1.3.6.1.2.1.69.1.6.4.1.2.7 -> 4 (i32)
TLV-11[38]: 1.3.6.1.2.1.69.1.6.4.1.3.7 -> 1 (i32)
TLV-11[39]: 1.3.6.1.2.1.69.1.6.4.1.4.7 -> 0 (i32)
TLV-11[40]: 1.3.6.1.2.1.69.1.6.4.1.5.7 -> 3 (i32)
TLV-11[41]: 1.3.6.1.2.1.69.1.6.4.1.6.7 -> 1 (i32)
TLV-11[42]: 1.3.6.1.2.1.69.1.6.4.1.11.7 -> 6 (i32)
TLV-11[43]: 1.3.6.1.2.1.69.1.6.4.1.12.7 -> 137 (i32)
TLV-11[44]: 1.3.6.1.2.1.69.1.6.4.1.13.7 -> 139 (i32)
TLV-11[45]: 1.3.6.1.2.1.69.1.6.4.1.14.7 -> 137 (i32)
TLV-11[46]: 1.3.6.1.2.1.69.1.6.4.1.15.7 -> 139 (i32)
TLV-11[47]: 1.3.6.1.2.1.69.1.6.3.0 -> 2 (i32)
TLV-11[48]: 1.3.6.1.2.1.69.1.2.1.8.1 -> 1 (i32)
TLV-11[49]: 1.3.6.1.2.1.69.1.6.1.0 -> 2 (i32)
Not logging event ID 2291949524, control for level 7 is 0.
Not logging event ID 2291949324, control for level 7 is 0.
SB5102 CM Agent w/ BRCM Factory Support processing TLV-11's
SNMP packet sent to 10.7.224.242:225
49 TLV-11's OK.
Sending a REG-REQ to the CMTS...
Received a REG-RSP message from the CMTS...
0x0000841c [CmDocsisCtlThread] BcmCmDocsisCtlThread::RegRspMsgEvent: (CmDocsisCtlThread) ERROR -
REG-RSP response code NOT ok! rsp code = 11 (kRejAuthFailureBadHmac)
0x0000841c [CmDocsisCtlThread] BcmCmDocsisCtlThread::SyncRestartErrorEvent: (CmDocsisCtlThread) reason: 17 (kNegOrBadRegRsp)
Not logging event ID 2436694040, control for level 7 is 0.
Logging event: Neg Or Bad Reg Rsp - Reinitialize MAC...
Deleting DOCSIS 1.0 CoS Settings for SID 0x1cb1
0x000084e4 [CmDocsisCtlThread] BcmDocsisCmHalIf::DeleteAllServiceFlows: (DOCSIS CableModem HalIf) Deleting all Upstream and Downstream Service Flows, along with associated Classifiers and PHS rules...
Stopping DHCP/ToD/TFTP (client requested)...
The ToD thread was stopped.
DHCPc: Releasing the lease with client id htype=1, value=cm-001axxxxxx
DHCPc: Sending Release packet; client id htype=1, value=cm-001axxxxxx
0x000084ee [DHCP Client Thread] BcmDhcpClientIf::SendDhcpPacket: (DHCP ClientIf for IP Stack1) WARNING - Failed to send packet!
0x000084ee [DHCP Client Thread] BcmDhcpClientIf::SendRelease: (DHCP ClientIf for IP Stack1) WARNING - Failed to create/send Release packet! Oh, well, no biggie...
0x000084ee [DHCP Client Thread] BcmEcosIpHalIf::RemoveLeaseImpl: (IP Stack1 HalIf) Removing lease IP address 10.7.224.242 from IP stack 1
0x000084f8 [DHCP Client Thread] BcmEcosIpHalIf::RemoveLeaseImpl: (IP Stack1 HalIf) This is the last address on the stack; shutting the stack down:numberOfAddresses=1
0x000084f8 [DHCP Client Thread] BcmEcosIpHalIf::ShutdownIpStackImpl: (IP Stack1 HalIf)
Shutting down IP stack 1
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=0.0.0.0, Subnet=0.0.0.0, Gateway=0.0.0.0
DefaultSnmpAgentClass::RestartPendingEvent for SB5102 CM Agent w/ BRCM Factory Support
SB5102 CM Agent w/ BRCM Factory Support resetting to default state.
SB5102 CM Agent w/ BRCM Factory Support destroying users...
Pausing trap thread
SB5102 CM Agent w/ BRCM Factory Support destroying notifies...
Resuming trap thread
SB5102 CM Agent w/ BRCM Factory Support destroying views...
SB5102 CM Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SB5102 CM Event Log w/ BRCM Factory Support sending deferred async messages...
Done w/ deferred msgs
SB5102 CM Agent w/ BRCM Factory Support defering traps.
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to unrestricted
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisCpeView
Non-Vol Settings successfully written to the device.
0x000085fc [CmDocsisCtlThread] BcmCmDocsisCtlThread::ResetRngState: (CmDocsisCtlThread)
@@@@@ In ResetRngState, fRemainingInitRngPowerSteps 17
0x00008606 [Scan Downstream Thread] BcmVendorCmDownstreamScanThread::ThreadMain: (Scan Downstream Thread) Downstream Channel scan stopped!
0x00008610 [Scan Downstream Thread] BcmVendorCmDownstreamScanThread::ThreadMain: (Scan Downstream Thread) Scanning for a Downstream Channel...
mot_scanList: Setting override freq @ 699000000
Scanning DS Channel at 699000000 Hz... (Initial target freq)
CM> Found energy at frequency 699000000Hz! Publishing event kEventEnergyDetected...
0x0000889a [CmDocsisCtlThread] BcmCmDocsisCtlThread::StartUsInit: (CmDocsisCtlThread) Locked on the downstream. Waiting for UCDs...At what time would you suggest to load the cfg during reg/handshake? Im thinking at the time of 0x0000841c. PM if not safe to post here.
Cheers
RE: Need Help With Docsis + Certs Please Guys - klonoa - 15-11-2012
Did you get anywhere?
I would play around but I have to resolder a cap on my spare sb5101.
Not that I really need to test other than for curiosity's sake.
Already on comcast xtreme 105 ;p