25-09-2010, 01:34 AM
I did some testing with that spoof string (and a valid same model mac address) and it still changed the configuration from NoBPI to BPI. As a side-note, I wasn't able to override the HW_REV to 2.1. It always loses the ".2" part and turns to 2 after saving.
I'll do some more exact testing later tonight. I wanted to query the TFTP server after every step of a modem's sync-up, and see which step actually prompts the server to change the privacy setting. Is there any way to get a dhcpdump or any other information that the modem sends to the CMTS? Wireshark doesn't start capturing until after the modem is already synced. Also, is there source code to the firmware so I can audit it myself, or is it strictly modified assembly?
I'll do some more exact testing later tonight. I wanted to query the TFTP server after every step of a modem's sync-up, and see which step actually prompts the server to change the privacy setting. Is there any way to get a dhcpdump or any other information that the modem sends to the CMTS? Wireshark doesn't start capturing until after the modem is already synced. Also, is there source code to the firmware so I can audit it myself, or is it strictly modified assembly?