Something interesting

[Lucas Peet]

I read up on DOCSIS, and learned alot about cable modems.  Basically, all
this info is a log of a connection.

It starts by scanning for a good frequencies on the line - QAM is download
freqs, QSPK is upload.  It then goes through DHCP stuff, gets an IP (but
still cannot access the network).  It TFTPs down a config file containing
all kinds of stuff (including your caps, and authentication info), applies
it, then registers itself on the network - network access is good to go.

All this can be seen in the log a few posts ago - you can follow it through
all that.  I think the $ stuff is frequencies scanned, and frequencies
locked, etc...

-Lucas

----- Original Message -----
From: "Duane Attaway" <dattaway at attaway.yi.org>
To: "Lucas Peet" <lpeet at eccod.com>
Cc: <kclug at kclug.org>
Sent: Tuesday, May 07, 2002 4:02 PM
Subject: Re: Something interesting

> On Tue, 7 May 2002, Lucas Peet wrote:
>
> > If there's anyone who's paying for a 'Business' account...I'd like to
see
> > what their's say.
> >
> > I wonder if a sniffer would decode that better - like Ethereal or
somesuch.
> > And I'm curious as to what 'service' that is running on port 55555, and
what
> > all this information means.  Logging of some such, probably sent out to
RR,
> > and stuck in a log file somewhere...which is then parsed, and anything
> > flagged that seems out of whack - uncappers, etc...
>
> That's just all diagnostics information that happens to be available on
> port 55555.  If you are interested in reconfiguring the cablemodem itself,
> you had better know the encryption keys and snmp messaging.  I'm sure the
> crown jewels of road runner are kept in a safe place.  If they got out in
> the wild and caused problems, they'd have to send out the .bin file to all
> their modems.  I bet these modems are secure, else there would be a lot of
> michief going on that would annoy the rest of us.
>
> from the newsgroup roadrunner.kc.earlybird:
>
> "The cap is set at the modem itself with a Bin file that is sent from the
> cable company. If you have a Surfboard 3100, 4100, or a 3 Com "Sharkfin"
> you will be able to view these settings through the internal web
> diagnostics page on the modem itself."
>
> there was quite a discussion about all this...
>
> --
> Why drive a car when you can ride a bike?
> http://attaway.yi.org                   http://counter.li.org   user
#142150
>
>
>
>