22-10-2012, 03:30 AM
hi guys
after a bit of fiddling and lots of reading i was able to install haxorware on both of my netgear modems CG814WG. My legal modem is an arris tm602g.
I was able to get the following info from the arris while connected to the stream
______
Basic
______
RF Parameters
Downstream
Freq/Power: 555.000 MHz 1 dBmV
Signal to Noise Ratio: 41 dB
Modulation: QAM256
--------------------------------------------------------------------------------
Upstream
Freq/Power: 36.000 MHz 36 dBmV
Channel Type: DOCSIS 2.0 (ATDMA)
Symbol Rate: 5120 kSym/sec
Modulation: QAM16
Status
System Uptime: 0 days 2h:23m:21s
Computers Detected: 2
CM Status: Docsis-AC Power Iso OFF Data Reg Complete
Time and Date: SUN OCT 21 08:31:15 2012
Interface Parameters
Interface Name Provisioned State Speed MAC address
LAN Enabled UP 100 00-15-A4-88-C6-1A
CABLE Enabled UP ---- 00-15-A4-88-C6-1B
USB Enabled DOWN 12 00-15-A4-88-C6-1D
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C
________________
HW /FW Versions
________________
CM Hardware Information
System: ARRIS DOCSIS 2.0 / PacketCable 1.0 Touchstone Telephony Modem HW_REV: 04
VENDOR: Arris Interactive, L.L.C.
BOOTR: 6.03
SW_REV: 5.2.31
MODEL: TM602G
Product Type: 00000006 010a3be2
Product Release: 00000004
Flash Part: MX29LV320BTC
Download Revision: 2
Firmware Revision: 5.2.31
Serial Number: 7C5BNE766410895
Battery Charger FW Rev: 06.00
MTA Hardware Information
Mta Serial Number 7C5BNE766410895
Mta Type Identifier
Firmware Build and Revisions
Firmware Name: TS050231_092707_MODEL_4_5_6
Firmware Build Time: Thu Sep 27 14:49:24 EDT 2007
_________
CM State
_________
CM State: Docsis-AC Power Iso OFF Data Reg Complete
Complete Docsis-Downstream Scanning
Complete Docsis-Downstream Ranging
Complete Docsis-Upstream Ranging
Complete Docsis-DHCP
Complete Docsis-TFTP
Complete Docsis-Data Reg Complete
Not Started Telephony-DHCP
Not Started Telephony-TFTP
Not Started Telephony-Reg with Call Server
Not Started Telephony-Reg Complete
TOD State:
Retrieved Time of Day
BPI State:
Not Enabled BPI Status
DHCP Attempts to obtain CM IP Address:
1 Attempt(s)
Power Supply Telemetry:
Battery Port Battery Operational Status Battery Part Number
1 BATTERY MISSING No Battery
Battery Serial Number:
Battery Port 1 Battery Missing
_____________
Product
_____________
CM Status: Docsis-AC Power Iso OFF Data Reg Complete
WAN Isolation: OFF-Access to WAN is allowed and button is disabled
IP and MAC ADDR PARAMETERS
Interface Name Provisioned State Speed MAC address IP address Subnet Mask
LAN Enabled UP 100 00-15-A4-88-C6-1A 192.168.100.1 255.255.255.0
CABLE Enabled UP ---- 00-15-A4-88-C6-1B 10.32.3.19 255.255.0.0
USB Enabled DOWN 12 00-15-A4-88-C6-1D ---- ----
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C 0.0.0.0 0.0.0.0
Product Type
PRODUCT TYPE: 00000006 010a3be2 which means Hardware type GEN5
Hardware version 0
Market North America
Display LED
Num lines 2
RF version 7
USB capable YES
Internet isolation NOT AVAILABLE
TTM telemetry AVAILABLE
External watchdog NOT PRESENT
Wireless DISABLED
Router DISABLED
USB ENABLED
Ethernet ENABLED
PLL Workaround DISABLED
Japan DISABLED
Extended Tx Gain DISABLED
Midband US DISABLED
Wireless Docsis DISABLED
LC type 3
Thermal Shutdown DISABLED
CM Report Levels
CM Report Levels On: which means 1 CPU Usage 11 Downstream 21 Root
2 TCB 12 US Sniffer 22 CM Messages
3 Upstream 13 DS Sniffer 23 RSA
4 Hardware 14 QoS 24 SNM
5 Management 15 DSX 25 IGMP
6 Advanced PHY 16 CableNet 26 Security
7 Registration 17 Bridge 27 ALL
8 Sync 18 IP Apps 28 TurboDOX
9 BLP 19 Statistics 29 Application
10 TSM 20 Main S.M.
MTA Report Levels
MTA Report Levels On: which means 1 Main S.M 4 SNMP 7 Syslog
2 DHCP 5 Security 8 ALL
3 TFTP 6 Database
____________
DHCP
____________
SOFTWARE VERSION / PROVISIONING MODE
Firmware Name TS050231_092707_MODEL_4_5_6
Software filename TS050231_092707.bin.model_4_5_6
Provisioning Method DOCSIS only
CM DHCP PARAMETERS
CM IP Addr 10.32.3.19 DHCP - CM IP Time Remaining
CM IP SubnetMask 255.255.0.0 Lease: 22.4 days (1935761 seconds)
CM IP Gateway 10.32.0.1 Rebind: 19.6 days (1692761 seconds)
CM TFTP Server 172.16.25.11 Renew: 11.2 days (963761 seconds)
CM Time Server 172.16.25.10
CM Time Offset -28000
CM Boot file HSD_FlowPlus_5125.bin
CM PACKETCABLE OPTIONS:
SubOption 1 Service Provider's Primary DHCP 0.0.0.0
SubOption 2 Service Provider's Secondary DHCP 0.0.0.0
MTA DHCP PARAMETERS
MTA FQDN 0015a488c61b.flowgrenada.com DHCP - MTA IP Time Remaining
MTA IP Addr 0.0.0.0 Lease: 0.0 days (0 seconds)
MTA IP SubnetMask 0.0.0.0 Rebind: 0.0 days (0 seconds)
MTA IP Gateway 0.0.0.0 Renew: 0.0 days (0 seconds)
MTA Boot file
MTA DHCP OPTION 6:
Service Provider Network Primary DNS 63.245.66.41
Service Provider Network Secondary DNS 63.245.66.42
MTA PACKETCABLE OPTIONS:
SubOption Type 122
SubOption 3 Service Provider's SNMP Entity
SubOption 6 Kerberos Realm Realm (FQDN)
SubOption 7 Authorization method (MTA should get TGT) FALSE
SubOption 8 Provisioning timer (minutes) 10
SubOption 9 Security Ticket Invalidation 0
_____________
Config Params
_____________
QUICK JUMP URL:
CM HSD_FlowPlus_5125.bin
MTA
Warning: The modem does not store copies of its configuration files. Below you will find the values of parameters commonly set using these files. The files may or may not set these values or contain additional information. This information is listed for convenience only.
Common CM Config Parameters
NetworkAccess = Yes
UpgradeServer = 192.168.100.10
MaxCpeAllowed = 3
MaxClassifiers = 64
PrivacyEnable = 0
SnmpMib = docsDevSwAdminStatus.0 2
SnmpMib = ppCfgMtaCallpFeatureSwitch.0 0x247b
UpstreamServiceFlow =
SfReference = 0
# SfId = 30718777 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 1
SfMaxTrafficRate = 524288
SfMaxTrafficBurst = 4096
SfMinReservedRate = 0
SfMinReservedRatePktsize = 64
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 2048
SfSchedulingType = 2
SfRqTxPolicy = 128
DownstreamServiceFlow =
SfReference = 2
# SfId = 30718778 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 3
SfMaxTrafficRate = 4194304
SfMaxTrafficBurst = 3044
SfMinReservedRate = 0
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamServiceFlow =
SfReference = 1
# SfId = 30718791 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 0
SfSchedulingType = 2
SfRqTxPolicy = 352
DownstreamServiceFlow =
SfReference = 3
# SfId = 30718792 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamPacketClassification =
PcServiceFlow = 30718777
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
UpstreamPacketClassification =
PcServiceFlow = 30718791
PcIdentifier = 1
PcRulePriority = 2
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718778
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718792
PcIdentifier = 1
PcRulePriority = 3
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
# # Note: Items assigned by CMTS are not included in the config file.# PcSfId maps to Instance of docsQosServiceFlowTable.#
Common MTA Config Parameters
#
# DHCP Parameters -- not included in the config file
#SnmpMib = pktcMtaDevFQDN.0 0015a488c61b.flowgrenada.com
#
# MTA Parameters
SnmpMib = pktcMtaDevEnabled.0 2
SnmpMib = pktcSigDefCallSigTos.0 0
SnmpMib = pktcSigDefMediaStreamTos.0 0
SnmpMib = pktcSigTosFormatSelector.0 0
SnmpMib = ppCfgMtaCountryTemplate.0 17
SnmpMib = ppCfgMtaCableTvEnable.0 1
SnmpMib = ppCfgMtaDataInterface.0 1
#
# Line 9 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.1 1
SnmpMib = ppCfgPortLoopCurrent.1 2
SnmpMib = ppCfgPortTxGainControl.1 0
SnmpMib = ppCfgPortRxGainControl.1 0
#
# Line 10 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.2 1
SnmpMib = ppCfgPortLoopCurrent.2 2
SnmpMib = ppCfgPortTxGainControl.2 0
SnmpMib = ppCfgPortRxGainControl.2 0
© Copyright 2004-2007, ARRIS Group, Inc., All rights reserved.
using this info i tried to clone my modem with haxorware and got the following
Haxorware integrated telnet daemon
Username: cable
Password: *****
Welcome.
DHCPc: Sending Discover packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Offer from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease
client id htype=1, value=00:15:a4:88:c6:1b
CM>
CM> DHCPc: Timed out waiting for offers for lease with client id htype=1, value
=00:15:a4:88:c6:1b
DHCPc: Sending Request packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Ack from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease cl
ient id htype=1, value=00:15:a4:88:c6:1b
Current IP address is default 0.0.0.0.
0x00004dda [DHCP Client Thread] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack1
HalIf)
Configuring IP stack 1:
IP Address = 10.32.3.19 (primary IP address)
Subnet Mask = 255.255.0.0
Router = 10.32.0.1
IsPrimaryInterface = 1
Logging event: DHCP WARNING - Non-critical field invalid in response.
ARPing for default GW IP = 10.32.0.1
MAC = 00:01:5c:31:8d:c1
DHCP completed successfully!
DHCP Settings:
Client Id = htype=1, value=00:15:a4:88:c6:1b
State = Renewing (5)
Static Lease = 0
AutoConfig Mode = IP, Subnet and Router
XID = 0x162a7b6c
Number of Tries = 0
Max Discover Tries = 6
Max Request Tries = 6
DHCP server MAC addr = 00:01:5c:31:8d:c1
Ignore NAKs = 0
My offered IP address = 10.32.3.19 (primary IP address)
(1) Subnet Mask = 255.255.0.0
(3) Router IP address = 10.32.0.1
(54) DHCP Server IP address = 172.16.25.10
(82) Relay Agent IP address = 10.32.0.1
TFTP Server IP address = 172.16.25.10
CM Configuration file = 'HSD_FlowPlus_5125.bin'
(2) UTC Time Offset = -28000 seconds
(4) Time Server IP address = 172.16.25.10
(6) Domain Name Server = 63.245.66.41; 63.245.66.42
(7) Log Server IP address = 0.0.0.0
(51) Lease time = 1944000 seconds
(58) T1 (renew) = 972000 seconds
(59) T2 (rebind) = 1701000 seconds
Lease is infinite = 0
(122) PacketCable/CableHome -== SubOptions ==-
SubOpt(1) Primary Dhcp Server = 172.16.25.10
SubOpt(2) Secondary Dhcp Server = 172.16.25.11
SubOpt(3) Provisioning Server Address = 172.16.25.10
SubOpt(7) TicketGrantingServer Utilization = 0
SubOpt(8) Provisioning Timer = 0 minutes
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=10.32.3.19, Subnet=255.
255.0.0, Gateway=10.32.0.1
CmSnmpAgent::IpAddressAcquiredEvent for SB5102 CM Agent w/ BRCM Factory Suppor
t
IP addr = 10.32.3.19
Starting Time Of Day...
0x00004e8e [CmDocsisIpThread] BcmDocsisTimeOfDayThread::SetTodServerIpAddress:
(Time Of Day Thread) ToD servers: 172.16.25.10
Connecting to ToD server 172.16.25.10...
Sending UDP ToD request to server...
SNMP Agent Binding to 10.32.3.19:225
Not logging event ID 2291949724, control for level 7 is 0.
UTC returned by ToD server 3559859490; UTC offset -28000
Current system time -> Sun Oct 21 18:04:50 2012
System start time -> Sun Oct 21 18:04:30 2012
Starting Tftp of configuration file...
Opening file 'HSD_FlowPlus_5125.bin' on 172.16.25.10 for reading...
tftp-enforce bypass is DISABLED
TFTPD Started
Forcing Config TFTP IP to 127.0.0.1
Forcing Config File name to HSD_FlowOverdrive3.bin
TFTPD received 1 from 10.32.3.19:1028
Storing received cfg of size 1412 to memory
TFTPD Shut down
Tftp read < 512 bytes, we have reached end of file.
Tftp transfer complete!
TFTP Settings:
Stack Interface = 1
Server Ip Address = 172.16.25.10
Server Port Number = 1029
Total Blocks Read = 3
Total Bytes Read = 1412
Config file was read! IP Initialization completed...
MAX CPE per CM is being set to 32
TLV-11[1]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.2.0 -> 0 (i32) UNKNOWN, ignoring.
TLV-11[2]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.3.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[3]: 1.3.6.1.4.1.4115.10.1.20.0 -> 9339 (i32) UNKNOWN, ignoring.
TLV-11[4]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.4.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[5]: 1.3.6.1.4.1.4115.1.3.1.1.1.1.0 -> 3 (i32) UNKNOWN, ignoring.
Time Of Day completed...
DefaultSnmpAgentClass::SystemTimeChangeEvent for SB5102 CM Agent w/ BRCM Facto
ry Support
Sending a REG-REQ to the CMTS...
Received a REG-RSP message from the CMTS...
0x00005c62 [CmDocsisCtlThread] BcmCmDocsisCtlThread::RegRspMsgEvent: (CmDocsisC
tlThread) We registered with a DOCSIS 1.1 config file!
Registration complete!
Process CVC
DOCSIS CoS/QoS rate shaping enable is now 1
CmSnmpAgent::CmOperationalEvent for SB5102 CM Agent w/ BRCM Factory Support
CmSnmpAgent operating in 1.1 mode, including docsQos, excluding docsBpi
+++ No DH kickstart profiles or snmpCommunityTable entries installed.
We will operate in NMACCESS mode.
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessView
SB5102 CM Agent w/ BRCM Factory Support enabling management.
SB5102 CM Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessVie
w
0x00005c9e [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchBpkm: (CmDocs
isCtlThread) BPKM disabled via provisioned config file setting.
Enabling network access for all CPE ports.
mot_scanList: Writing to Flash!
BcmCmDocsisStatusEventCodes::kCmIsOperational
Suspending SNMP Thread
0x00005d34 [CmDocsisCtlThread] BcmVendorCmApplication::StopDhcpServer: (VendorE
xtension CmApp) Shutting down DHCP Server...
0x00005d34 [CmDocsisCtlThread] BcmStandbySwitchThread::CmIsOperational: (Motoro
la Standby Switch Thread) Simulating a press of the standby switch to get the st
ate configured properly.
0x00005d5c [IGMP Thread] BcmIgmpThread::Starting Igmp Thread...: (IGMP Thread)
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread::ThreadMain:
(Motorola Standby Switch Thread) Standby switch was pressed!
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread:
rocessSwitc
hEvent: (Motorola Standby Switch Thread) Standby switch disabled in nonvol; ign
oring event.
Not logging event ID 2291949524, control for level 7 is 0.
Not logging event ID 2291949324, control for level 7 is 0.
SB5102 CM Event Log w/ BRCM Factory Support sending deferred async messages...
Done w/ deferred msgs
Not logging event ID 2296948624, control for level 7 is 0.
CM>
The modem is able to surf but drops a huge amt of packets
also if i plug both modems on at the same time both constantly restarts, i suspect this is because it is using the same mac. I did a scan and obtained some macs but when i change the mac, it restarts constantly but my "legal" modem stays on.
Can any one help or point me in the right direction
after a bit of fiddling and lots of reading i was able to install haxorware on both of my netgear modems CG814WG. My legal modem is an arris tm602g.
I was able to get the following info from the arris while connected to the stream
______
Basic
______
RF Parameters
Downstream
Freq/Power: 555.000 MHz 1 dBmV
Signal to Noise Ratio: 41 dB
Modulation: QAM256
--------------------------------------------------------------------------------
Upstream
Freq/Power: 36.000 MHz 36 dBmV
Channel Type: DOCSIS 2.0 (ATDMA)
Symbol Rate: 5120 kSym/sec
Modulation: QAM16
Status
System Uptime: 0 days 2h:23m:21s
Computers Detected: 2
CM Status: Docsis-AC Power Iso OFF Data Reg Complete
Time and Date: SUN OCT 21 08:31:15 2012
Interface Parameters
Interface Name Provisioned State Speed MAC address
LAN Enabled UP 100 00-15-A4-88-C6-1A
CABLE Enabled UP ---- 00-15-A4-88-C6-1B
USB Enabled DOWN 12 00-15-A4-88-C6-1D
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C
________________
HW /FW Versions
________________
CM Hardware Information
System: ARRIS DOCSIS 2.0 / PacketCable 1.0 Touchstone Telephony Modem HW_REV: 04
VENDOR: Arris Interactive, L.L.C.
BOOTR: 6.03
SW_REV: 5.2.31
MODEL: TM602G
Product Type: 00000006 010a3be2
Product Release: 00000004
Flash Part: MX29LV320BTC
Download Revision: 2
Firmware Revision: 5.2.31
Serial Number: 7C5BNE766410895
Battery Charger FW Rev: 06.00
MTA Hardware Information
Mta Serial Number 7C5BNE766410895
Mta Type Identifier
Firmware Build and Revisions
Firmware Name: TS050231_092707_MODEL_4_5_6
Firmware Build Time: Thu Sep 27 14:49:24 EDT 2007
_________
CM State
_________
CM State: Docsis-AC Power Iso OFF Data Reg Complete
Complete Docsis-Downstream Scanning
Complete Docsis-Downstream Ranging
Complete Docsis-Upstream Ranging
Complete Docsis-DHCP
Complete Docsis-TFTP
Complete Docsis-Data Reg Complete
Not Started Telephony-DHCP
Not Started Telephony-TFTP
Not Started Telephony-Reg with Call Server
Not Started Telephony-Reg Complete
TOD State:
Retrieved Time of Day
BPI State:
Not Enabled BPI Status
DHCP Attempts to obtain CM IP Address:
1 Attempt(s)
Power Supply Telemetry:
Battery Port Battery Operational Status Battery Part Number
1 BATTERY MISSING No Battery
Battery Serial Number:
Battery Port 1 Battery Missing
_____________
Product
_____________
CM Status: Docsis-AC Power Iso OFF Data Reg Complete
WAN Isolation: OFF-Access to WAN is allowed and button is disabled
IP and MAC ADDR PARAMETERS
Interface Name Provisioned State Speed MAC address IP address Subnet Mask
LAN Enabled UP 100 00-15-A4-88-C6-1A 192.168.100.1 255.255.255.0
CABLE Enabled UP ---- 00-15-A4-88-C6-1B 10.32.3.19 255.255.0.0
USB Enabled DOWN 12 00-15-A4-88-C6-1D ---- ----
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C 0.0.0.0 0.0.0.0
Product Type
PRODUCT TYPE: 00000006 010a3be2 which means Hardware type GEN5
Hardware version 0
Market North America
Display LED
Num lines 2
RF version 7
USB capable YES
Internet isolation NOT AVAILABLE
TTM telemetry AVAILABLE
External watchdog NOT PRESENT
Wireless DISABLED
Router DISABLED
USB ENABLED
Ethernet ENABLED
PLL Workaround DISABLED
Japan DISABLED
Extended Tx Gain DISABLED
Midband US DISABLED
Wireless Docsis DISABLED
LC type 3
Thermal Shutdown DISABLED
CM Report Levels
CM Report Levels On: which means 1 CPU Usage 11 Downstream 21 Root
2 TCB 12 US Sniffer 22 CM Messages
3 Upstream 13 DS Sniffer 23 RSA
4 Hardware 14 QoS 24 SNM
5 Management 15 DSX 25 IGMP
6 Advanced PHY 16 CableNet 26 Security
7 Registration 17 Bridge 27 ALL
8 Sync 18 IP Apps 28 TurboDOX
9 BLP 19 Statistics 29 Application
10 TSM 20 Main S.M.
MTA Report Levels
MTA Report Levels On: which means 1 Main S.M 4 SNMP 7 Syslog
2 DHCP 5 Security 8 ALL
3 TFTP 6 Database
____________
DHCP
____________
SOFTWARE VERSION / PROVISIONING MODE
Firmware Name TS050231_092707_MODEL_4_5_6
Software filename TS050231_092707.bin.model_4_5_6
Provisioning Method DOCSIS only
CM DHCP PARAMETERS
CM IP Addr 10.32.3.19 DHCP - CM IP Time Remaining
CM IP SubnetMask 255.255.0.0 Lease: 22.4 days (1935761 seconds)
CM IP Gateway 10.32.0.1 Rebind: 19.6 days (1692761 seconds)
CM TFTP Server 172.16.25.11 Renew: 11.2 days (963761 seconds)
CM Time Server 172.16.25.10
CM Time Offset -28000
CM Boot file HSD_FlowPlus_5125.bin
CM PACKETCABLE OPTIONS:
SubOption 1 Service Provider's Primary DHCP 0.0.0.0
SubOption 2 Service Provider's Secondary DHCP 0.0.0.0
MTA DHCP PARAMETERS
MTA FQDN 0015a488c61b.flowgrenada.com DHCP - MTA IP Time Remaining
MTA IP Addr 0.0.0.0 Lease: 0.0 days (0 seconds)
MTA IP SubnetMask 0.0.0.0 Rebind: 0.0 days (0 seconds)
MTA IP Gateway 0.0.0.0 Renew: 0.0 days (0 seconds)
MTA Boot file
MTA DHCP OPTION 6:
Service Provider Network Primary DNS 63.245.66.41
Service Provider Network Secondary DNS 63.245.66.42
MTA PACKETCABLE OPTIONS:
SubOption Type 122
SubOption 3 Service Provider's SNMP Entity
SubOption 6 Kerberos Realm Realm (FQDN)
SubOption 7 Authorization method (MTA should get TGT) FALSE
SubOption 8 Provisioning timer (minutes) 10
SubOption 9 Security Ticket Invalidation 0
_____________
Config Params
_____________
QUICK JUMP URL:
CM HSD_FlowPlus_5125.bin
MTA
Warning: The modem does not store copies of its configuration files. Below you will find the values of parameters commonly set using these files. The files may or may not set these values or contain additional information. This information is listed for convenience only.
Common CM Config Parameters
NetworkAccess = Yes
UpgradeServer = 192.168.100.10
MaxCpeAllowed = 3
MaxClassifiers = 64
PrivacyEnable = 0
SnmpMib = docsDevSwAdminStatus.0 2
SnmpMib = ppCfgMtaCallpFeatureSwitch.0 0x247b
UpstreamServiceFlow =
SfReference = 0
# SfId = 30718777 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 1
SfMaxTrafficRate = 524288
SfMaxTrafficBurst = 4096
SfMinReservedRate = 0
SfMinReservedRatePktsize = 64
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 2048
SfSchedulingType = 2
SfRqTxPolicy = 128
DownstreamServiceFlow =
SfReference = 2
# SfId = 30718778 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 3
SfMaxTrafficRate = 4194304
SfMaxTrafficBurst = 3044
SfMinReservedRate = 0
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamServiceFlow =
SfReference = 1
# SfId = 30718791 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 0
SfSchedulingType = 2
SfRqTxPolicy = 352
DownstreamServiceFlow =
SfReference = 3
# SfId = 30718792 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamPacketClassification =
PcServiceFlow = 30718777
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
UpstreamPacketClassification =
PcServiceFlow = 30718791
PcIdentifier = 1
PcRulePriority = 2
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718778
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718792
PcIdentifier = 1
PcRulePriority = 3
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
# # Note: Items assigned by CMTS are not included in the config file.# PcSfId maps to Instance of docsQosServiceFlowTable.#
Common MTA Config Parameters
#
# DHCP Parameters -- not included in the config file
#SnmpMib = pktcMtaDevFQDN.0 0015a488c61b.flowgrenada.com
#
# MTA Parameters
SnmpMib = pktcMtaDevEnabled.0 2
SnmpMib = pktcSigDefCallSigTos.0 0
SnmpMib = pktcSigDefMediaStreamTos.0 0
SnmpMib = pktcSigTosFormatSelector.0 0
SnmpMib = ppCfgMtaCountryTemplate.0 17
SnmpMib = ppCfgMtaCableTvEnable.0 1
SnmpMib = ppCfgMtaDataInterface.0 1
#
# Line 9 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.1 1
SnmpMib = ppCfgPortLoopCurrent.1 2
SnmpMib = ppCfgPortTxGainControl.1 0
SnmpMib = ppCfgPortRxGainControl.1 0
#
# Line 10 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.2 1
SnmpMib = ppCfgPortLoopCurrent.2 2
SnmpMib = ppCfgPortTxGainControl.2 0
SnmpMib = ppCfgPortRxGainControl.2 0
© Copyright 2004-2007, ARRIS Group, Inc., All rights reserved.
using this info i tried to clone my modem with haxorware and got the following
Haxorware integrated telnet daemon
Username: cable
Password: *****
Welcome.
DHCPc: Sending Discover packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Offer from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease
client id htype=1, value=00:15:a4:88:c6:1b
CM>
CM> DHCPc: Timed out waiting for offers for lease with client id htype=1, value
=00:15:a4:88:c6:1b
DHCPc: Sending Request packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Ack from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease cl
ient id htype=1, value=00:15:a4:88:c6:1b
Current IP address is default 0.0.0.0.
0x00004dda [DHCP Client Thread] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack1
HalIf)
Configuring IP stack 1:
IP Address = 10.32.3.19 (primary IP address)
Subnet Mask = 255.255.0.0
Router = 10.32.0.1
IsPrimaryInterface = 1
Logging event: DHCP WARNING - Non-critical field invalid in response.
ARPing for default GW IP = 10.32.0.1
MAC = 00:01:5c:31:8d:c1
DHCP completed successfully!
DHCP Settings:
Client Id = htype=1, value=00:15:a4:88:c6:1b
State = Renewing (5)
Static Lease = 0
AutoConfig Mode = IP, Subnet and Router
XID = 0x162a7b6c
Number of Tries = 0
Max Discover Tries = 6
Max Request Tries = 6
DHCP server MAC addr = 00:01:5c:31:8d:c1
Ignore NAKs = 0
My offered IP address = 10.32.3.19 (primary IP address)
(1) Subnet Mask = 255.255.0.0
(3) Router IP address = 10.32.0.1
(54) DHCP Server IP address = 172.16.25.10
(82) Relay Agent IP address = 10.32.0.1
TFTP Server IP address = 172.16.25.10
CM Configuration file = 'HSD_FlowPlus_5125.bin'
(2) UTC Time Offset = -28000 seconds
(4) Time Server IP address = 172.16.25.10
(6) Domain Name Server = 63.245.66.41; 63.245.66.42
(7) Log Server IP address = 0.0.0.0
(51) Lease time = 1944000 seconds
(58) T1 (renew) = 972000 seconds
(59) T2 (rebind) = 1701000 seconds
Lease is infinite = 0
(122) PacketCable/CableHome -== SubOptions ==-
SubOpt(1) Primary Dhcp Server = 172.16.25.10
SubOpt(2) Secondary Dhcp Server = 172.16.25.11
SubOpt(3) Provisioning Server Address = 172.16.25.10
SubOpt(7) TicketGrantingServer Utilization = 0
SubOpt(8) Provisioning Timer = 0 minutes
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=10.32.3.19, Subnet=255.
255.0.0, Gateway=10.32.0.1
CmSnmpAgent::IpAddressAcquiredEvent for SB5102 CM Agent w/ BRCM Factory Suppor
t
IP addr = 10.32.3.19
Starting Time Of Day...
0x00004e8e [CmDocsisIpThread] BcmDocsisTimeOfDayThread::SetTodServerIpAddress:
(Time Of Day Thread) ToD servers: 172.16.25.10
Connecting to ToD server 172.16.25.10...
Sending UDP ToD request to server...
SNMP Agent Binding to 10.32.3.19:225
Not logging event ID 2291949724, control for level 7 is 0.
UTC returned by ToD server 3559859490; UTC offset -28000
Current system time -> Sun Oct 21 18:04:50 2012
System start time -> Sun Oct 21 18:04:30 2012
Starting Tftp of configuration file...
Opening file 'HSD_FlowPlus_5125.bin' on 172.16.25.10 for reading...
tftp-enforce bypass is DISABLED
TFTPD Started
Forcing Config TFTP IP to 127.0.0.1
Forcing Config File name to HSD_FlowOverdrive3.bin
TFTPD received 1 from 10.32.3.19:1028
Storing received cfg of size 1412 to memory
TFTPD Shut down
Tftp read < 512 bytes, we have reached end of file.
Tftp transfer complete!
TFTP Settings:
Stack Interface = 1
Server Ip Address = 172.16.25.10
Server Port Number = 1029
Total Blocks Read = 3
Total Bytes Read = 1412
Config file was read! IP Initialization completed...
MAX CPE per CM is being set to 32
TLV-11[1]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.2.0 -> 0 (i32) UNKNOWN, ignoring.
TLV-11[2]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.3.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[3]: 1.3.6.1.4.1.4115.10.1.20.0 -> 9339 (i32) UNKNOWN, ignoring.
TLV-11[4]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.4.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[5]: 1.3.6.1.4.1.4115.1.3.1.1.1.1.0 -> 3 (i32) UNKNOWN, ignoring.
Time Of Day completed...
DefaultSnmpAgentClass::SystemTimeChangeEvent for SB5102 CM Agent w/ BRCM Facto
ry Support
Sending a REG-REQ to the CMTS...
Received a REG-RSP message from the CMTS...
0x00005c62 [CmDocsisCtlThread] BcmCmDocsisCtlThread::RegRspMsgEvent: (CmDocsisC
tlThread) We registered with a DOCSIS 1.1 config file!
Registration complete!
Process CVC
DOCSIS CoS/QoS rate shaping enable is now 1
CmSnmpAgent::CmOperationalEvent for SB5102 CM Agent w/ BRCM Factory Support
CmSnmpAgent operating in 1.1 mode, including docsQos, excluding docsBpi
+++ No DH kickstart profiles or snmpCommunityTable entries installed.
We will operate in NMACCESS mode.
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessView
SB5102 CM Agent w/ BRCM Factory Support enabling management.
SB5102 CM Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessVie
w
0x00005c9e [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchBpkm: (CmDocs
isCtlThread) BPKM disabled via provisioned config file setting.
Enabling network access for all CPE ports.
mot_scanList: Writing to Flash!
BcmCmDocsisStatusEventCodes::kCmIsOperational
Suspending SNMP Thread
0x00005d34 [CmDocsisCtlThread] BcmVendorCmApplication::StopDhcpServer: (VendorE
xtension CmApp) Shutting down DHCP Server...
0x00005d34 [CmDocsisCtlThread] BcmStandbySwitchThread::CmIsOperational: (Motoro
la Standby Switch Thread) Simulating a press of the standby switch to get the st
ate configured properly.
0x00005d5c [IGMP Thread] BcmIgmpThread::Starting Igmp Thread...: (IGMP Thread)
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread::ThreadMain:
(Motorola Standby Switch Thread) Standby switch was pressed!
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread:
rocessSwitchEvent: (Motorola Standby Switch Thread) Standby switch disabled in nonvol; ign
oring event.
Not logging event ID 2291949524, control for level 7 is 0.
Not logging event ID 2291949324, control for level 7 is 0.
SB5102 CM Event Log w/ BRCM Factory Support sending deferred async messages...
Done w/ deferred msgs
Not logging event ID 2296948624, control for level 7 is 0.
CM>
The modem is able to surf but drops a huge amt of packets
also if i plug both modems on at the same time both constantly restarts, i suspect this is because it is using the same mac. I did a scan and obtained some macs but when i change the mac, it restarts constantly but my "legal" modem stays on.
Can any one help or point me in the right direction
