Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
newbie help needed
#1
hi guys
after a bit of fiddling and lots of reading i was able to install haxorware on both of my netgear modems CG814WG. My legal modem is an arris tm602g.
I was able to get the following info from the arris while connected to the stream

______
Basic
______


RF Parameters

Downstream
Freq/Power: 555.000 MHz 1 dBmV
Signal to Noise Ratio: 41 dB
Modulation: QAM256

--------------------------------------------------------------------------------
Upstream
Freq/Power: 36.000 MHz 36 dBmV
Channel Type: DOCSIS 2.0 (ATDMA)

Symbol Rate: 5120 kSym/sec

Modulation: QAM16

Status

System Uptime: 0 days 2h:23m:21s
Computers Detected: 2
CM Status: Docsis-AC Power Iso OFF Data Reg Complete
Time and Date: SUN OCT 21 08:31:15 2012


Interface Parameters

Interface Name Provisioned State Speed MAC address
LAN Enabled UP 100 00-15-A4-88-C6-1A
CABLE Enabled UP ---- 00-15-A4-88-C6-1B
USB Enabled DOWN 12 00-15-A4-88-C6-1D
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C





________________
HW /FW Versions
________________

CM Hardware Information

System: ARRIS DOCSIS 2.0 / PacketCable 1.0 Touchstone Telephony Modem HW_REV: 04
VENDOR: Arris Interactive, L.L.C.
BOOTR: 6.03
SW_REV: 5.2.31
MODEL: TM602G
Product Type: 00000006 010a3be2
Product Release: 00000004
Flash Part: MX29LV320BTC
Download Revision: 2
Firmware Revision: 5.2.31
Serial Number: 7C5BNE766410895
Battery Charger FW Rev: 06.00

MTA Hardware Information

Mta Serial Number 7C5BNE766410895
Mta Type Identifier

Firmware Build and Revisions

Firmware Name: TS050231_092707_MODEL_4_5_6
Firmware Build Time: Thu Sep 27 14:49:24 EDT 2007


_________
CM State
_________

CM State: Docsis-AC Power Iso OFF Data Reg Complete
Complete Docsis-Downstream Scanning
Complete Docsis-Downstream Ranging
Complete Docsis-Upstream Ranging
Complete Docsis-DHCP
Complete Docsis-TFTP
Complete Docsis-Data Reg Complete
Not Started Telephony-DHCP
Not Started Telephony-TFTP
Not Started Telephony-Reg with Call Server
Not Started Telephony-Reg Complete

TOD State:
Retrieved Time of Day

BPI State:
Not Enabled BPI Status

DHCP Attempts to obtain CM IP Address:
1 Attempt(s)

Power Supply Telemetry:
Battery Port Battery Operational Status Battery Part Number
1 BATTERY MISSING No Battery

Battery Serial Number:
Battery Port 1 Battery Missing


_____________
Product
_____________

CM Status: Docsis-AC Power Iso OFF Data Reg Complete
WAN Isolation: OFF-Access to WAN is allowed and button is disabled

IP and MAC ADDR PARAMETERS

Interface Name Provisioned State Speed MAC address IP address Subnet Mask
LAN Enabled UP 100 00-15-A4-88-C6-1A 192.168.100.1 255.255.255.0
CABLE Enabled UP ---- 00-15-A4-88-C6-1B 10.32.3.19 255.255.0.0
USB Enabled DOWN 12 00-15-A4-88-C6-1D ---- ----
MTA Disabled DOWN ---- 00-15-A4-88-C6-1C 0.0.0.0 0.0.0.0

Product Type

PRODUCT TYPE: 00000006 010a3be2 which means Hardware type GEN5
Hardware version 0
Market North America
Display LED
Num lines 2
RF version 7
USB capable YES
Internet isolation NOT AVAILABLE
TTM telemetry AVAILABLE
External watchdog NOT PRESENT
Wireless DISABLED
Router DISABLED
USB ENABLED
Ethernet ENABLED
PLL Workaround DISABLED
Japan DISABLED
Extended Tx Gain DISABLED
Midband US DISABLED
Wireless Docsis DISABLED
LC type 3
Thermal Shutdown DISABLED

CM Report Levels

CM Report Levels On: which means 1 CPU Usage 11 Downstream 21 Root
2 TCB 12 US Sniffer 22 CM Messages
3 Upstream 13 DS Sniffer 23 RSA
4 Hardware 14 QoS 24 SNM
5 Management 15 DSX 25 IGMP
6 Advanced PHY 16 CableNet 26 Security
7 Registration 17 Bridge 27 ALL
8 Sync 18 IP Apps 28 TurboDOX
9 BLP 19 Statistics 29 Application
10 TSM 20 Main S.M.

MTA Report Levels

MTA Report Levels On: which means 1 Main S.M 4 SNMP 7 Syslog
2 DHCP 5 Security 8 ALL
3 TFTP 6 Database



____________
DHCP
____________


SOFTWARE VERSION / PROVISIONING MODE

Firmware Name TS050231_092707_MODEL_4_5_6
Software filename TS050231_092707.bin.model_4_5_6
Provisioning Method DOCSIS only

CM DHCP PARAMETERS

CM IP Addr 10.32.3.19 DHCP - CM IP Time Remaining
CM IP SubnetMask 255.255.0.0 Lease: 22.4 days (1935761 seconds)
CM IP Gateway 10.32.0.1 Rebind: 19.6 days (1692761 seconds)
CM TFTP Server 172.16.25.11 Renew: 11.2 days (963761 seconds)
CM Time Server 172.16.25.10
CM Time Offset -28000
CM Boot file HSD_FlowPlus_5125.bin

CM PACKETCABLE OPTIONS:
SubOption 1 Service Provider's Primary DHCP 0.0.0.0
SubOption 2 Service Provider's Secondary DHCP 0.0.0.0

MTA DHCP PARAMETERS

MTA FQDN 0015a488c61b.flowgrenada.com DHCP - MTA IP Time Remaining
MTA IP Addr 0.0.0.0 Lease: 0.0 days (0 seconds)
MTA IP SubnetMask 0.0.0.0 Rebind: 0.0 days (0 seconds)
MTA IP Gateway 0.0.0.0 Renew: 0.0 days (0 seconds)
MTA Boot file

MTA DHCP OPTION 6:
Service Provider Network Primary DNS 63.245.66.41
Service Provider Network Secondary DNS 63.245.66.42

MTA PACKETCABLE OPTIONS:
SubOption Type 122
SubOption 3 Service Provider's SNMP Entity
SubOption 6 Kerberos Realm Realm (FQDN)
SubOption 7 Authorization method (MTA should get TGT) FALSE
SubOption 8 Provisioning timer (minutes) 10
SubOption 9 Security Ticket Invalidation 0




_____________
Config Params
_____________


QUICK JUMP URL:
CM HSD_FlowPlus_5125.bin
MTA

Warning: The modem does not store copies of its configuration files. Below you will find the values of parameters commonly set using these files. The files may or may not set these values or contain additional information. This information is listed for convenience only.


Common CM Config Parameters

NetworkAccess = Yes
UpgradeServer = 192.168.100.10
MaxCpeAllowed = 3
MaxClassifiers = 64
PrivacyEnable = 0
SnmpMib = docsDevSwAdminStatus.0 2
SnmpMib = ppCfgMtaCallpFeatureSwitch.0 0x247b
UpstreamServiceFlow =
SfReference = 0
# SfId = 30718777 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 1
SfMaxTrafficRate = 524288
SfMaxTrafficBurst = 4096
SfMinReservedRate = 0
SfMinReservedRatePktsize = 64
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 2048
SfSchedulingType = 2
SfRqTxPolicy = 128
DownstreamServiceFlow =
SfReference = 2
# SfId = 30718778 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 3
SfMaxTrafficRate = 4194304
SfMaxTrafficBurst = 3044
SfMinReservedRate = 0
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamServiceFlow =
SfReference = 1
# SfId = 30718791 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
SfMaxConcatBurst = 0
SfSchedulingType = 2
SfRqTxPolicy = 352
DownstreamServiceFlow =
SfReference = 3
# SfId = 30718792 -- assigned by CMTS, correlates to PcSfId
SfClassName = ""
SfQosSetType = 7
SfTrafficPriority = 7
SfMaxTrafficRate = 0
SfMaxTrafficBurst = 3044
SfMinReservedRate = 8000
SfMinReservedRatePktsize = 0
SfActiveQosTimeout = 0
SfAdmittedQosTimeout = 200
UpstreamPacketClassification =
PcServiceFlow = 30718777
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
UpstreamPacketClassification =
PcServiceFlow = 30718791
PcIdentifier = 1
PcRulePriority = 2
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpSourcePortStart = 0
PcIpSourcePortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718778
PcIdentifier = 1
PcRulePriority = 1
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
DownstreamPacketClassification =
PcServiceFlow = 30718792
PcIdentifier = 1
PcRulePriority = 3
PcActivationState = 1
PcIpClassification =
PcIpProtocol = 258
PcIpDestPortStart = 0
PcIpDestPortEnd = 65535
# # Note: Items assigned by CMTS are not included in the config file.# PcSfId maps to Instance of docsQosServiceFlowTable.#

Common MTA Config Parameters

#
# DHCP Parameters -- not included in the config file
#SnmpMib = pktcMtaDevFQDN.0 0015a488c61b.flowgrenada.com
#
# MTA Parameters
SnmpMib = pktcMtaDevEnabled.0 2
SnmpMib = pktcSigDefCallSigTos.0 0
SnmpMib = pktcSigDefMediaStreamTos.0 0
SnmpMib = pktcSigTosFormatSelector.0 0
SnmpMib = ppCfgMtaCountryTemplate.0 17
SnmpMib = ppCfgMtaCableTvEnable.0 1
SnmpMib = ppCfgMtaDataInterface.0 1
#
# Line 9 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.1 1
SnmpMib = ppCfgPortLoopCurrent.1 2
SnmpMib = ppCfgPortTxGainControl.1 0
SnmpMib = ppCfgPortRxGainControl.1 0
#
# Line 10 Parameters
#
SnmpMib = ppCfgPortLocUserIndication.2 1
SnmpMib = ppCfgPortLoopCurrent.2 2
SnmpMib = ppCfgPortTxGainControl.2 0
SnmpMib = ppCfgPortRxGainControl.2 0



© Copyright 2004-2007, ARRIS Group, Inc., All rights reserved.


using this info i tried to clone my modem with haxorware and got the following

Haxorware integrated telnet daemon

Username: cable
Password: *****
Welcome.
DHCPc: Sending Discover packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Offer from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease
client id htype=1, value=00:15:a4:88:c6:1b
CM>
CM> DHCPc: Timed out waiting for offers for lease with client id htype=1, value
=00:15:a4:88:c6:1b
DHCPc: Sending Request packet; client id htype=1, value=00:15:a4:88:c6:1b
DHCPc: Received an Ack from DHCP server 00:01:5c:31:8d:c1 (10.32.0.1); lease cl
ient id htype=1, value=00:15:a4:88:c6:1b
Current IP address is default 0.0.0.0.
0x00004dda [DHCP Client Thread] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack1
HalIf)
Configuring IP stack 1:
IP Address = 10.32.3.19 (primary IP address)
Subnet Mask = 255.255.0.0
Router = 10.32.0.1
IsPrimaryInterface = 1

Logging event: DHCP WARNING - Non-critical field invalid in response.
ARPing for default GW IP = 10.32.0.1
MAC = 00:01:5c:31:8d:c1
DHCP completed successfully!

DHCP Settings:
Client Id = htype=1, value=00:15:a4:88:c6:1b
State = Renewing (5)
Static Lease = 0
AutoConfig Mode = IP, Subnet and Router
XID = 0x162a7b6c
Number of Tries = 0
Max Discover Tries = 6
Max Request Tries = 6
DHCP server MAC addr = 00:01:5c:31:8d:c1
Ignore NAKs = 0
My offered IP address = 10.32.3.19 (primary IP address)
(1) Subnet Mask = 255.255.0.0
(3) Router IP address = 10.32.0.1
(54) DHCP Server IP address = 172.16.25.10
(82) Relay Agent IP address = 10.32.0.1
TFTP Server IP address = 172.16.25.10
CM Configuration file = 'HSD_FlowPlus_5125.bin'
(2) UTC Time Offset = -28000 seconds
(4) Time Server IP address = 172.16.25.10
(6) Domain Name Server = 63.245.66.41; 63.245.66.42
(7) Log Server IP address = 0.0.0.0
(51) Lease time = 1944000 seconds
(58) T1 (renew) = 972000 seconds
(59) T2 (rebind) = 1701000 seconds
Lease is infinite = 0

(122) PacketCable/CableHome -== SubOptions ==-
SubOpt(1) Primary Dhcp Server = 172.16.25.10
SubOpt(2) Secondary Dhcp Server = 172.16.25.11
SubOpt(3) Provisioning Server Address = 172.16.25.10
SubOpt(7) TicketGrantingServer Utilization = 0
SubOpt(8) Provisioning Timer = 0 minutes


SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=10.32.3.19, Subnet=255.
255.0.0, Gateway=10.32.0.1
CmSnmpAgent::IpAddressAcquiredEvent for SB5102 CM Agent w/ BRCM Factory Suppor
t
IP addr = 10.32.3.19
Starting Time Of Day...
0x00004e8e [CmDocsisIpThread] BcmDocsisTimeOfDayThread::SetTodServerIpAddress:
(Time Of Day Thread) ToD servers: 172.16.25.10
Connecting to ToD server 172.16.25.10...
Sending UDP ToD request to server...
SNMP Agent Binding to 10.32.3.19:225
Not logging event ID 2291949724, control for level 7 is 0.
UTC returned by ToD server 3559859490; UTC offset -28000
Current system time -> Sun Oct 21 18:04:50 2012

System start time -> Sun Oct 21 18:04:30 2012

Starting Tftp of configuration file...
Opening file 'HSD_FlowPlus_5125.bin' on 172.16.25.10 for reading...
tftp-enforce bypass is DISABLED
TFTPD Started
Forcing Config TFTP IP to 127.0.0.1
Forcing Config File name to HSD_FlowOverdrive3.bin
TFTPD received 1 from 10.32.3.19:1028
Storing received cfg of size 1412 to memory
TFTPD Shut down
Tftp read < 512 bytes, we have reached end of file.
Tftp transfer complete!
TFTP Settings:
Stack Interface = 1
Server Ip Address = 172.16.25.10
Server Port Number = 1029
Total Blocks Read = 3
Total Bytes Read = 1412

Config file was read! IP Initialization completed...
MAX CPE per CM is being set to 32
TLV-11[1]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.2.0 -> 0 (i32) UNKNOWN, ignoring.
TLV-11[2]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.3.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[3]: 1.3.6.1.4.1.4115.10.1.20.0 -> 9339 (i32) UNKNOWN, ignoring.
TLV-11[4]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.4.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[5]: 1.3.6.1.4.1.4115.1.3.1.1.1.1.0 -> 3 (i32) UNKNOWN, ignoring.
Time Of Day completed...
DefaultSnmpAgentClass::SystemTimeChangeEvent for SB5102 CM Agent w/ BRCM Facto
ry Support
Sending a REG-REQ to the CMTS...
Received a REG-RSP message from the CMTS...
0x00005c62 [CmDocsisCtlThread] BcmCmDocsisCtlThread::RegRspMsgEvent: (CmDocsisC
tlThread) We registered with a DOCSIS 1.1 config file!
Registration complete!
Process CVC
DOCSIS CoS/QoS rate shaping enable is now 1
CmSnmpAgent::CmOperationalEvent for SB5102 CM Agent w/ BRCM Factory Support
CmSnmpAgent operating in 1.1 mode, including docsQos, excluding docsBpi
+++ No DH kickstart profiles or snmpCommunityTable entries installed.
We will operate in NMACCESS mode.
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessView
SB5102 CM Agent w/ BRCM Factory Support enabling management.
SB5102 CM Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessVie
w
0x00005c9e [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchBpkm: (CmDocs
isCtlThread) BPKM disabled via provisioned config file setting.
Enabling network access for all CPE ports.

mot_scanList: Writing to Flash!
BcmCmDocsisStatusEventCodes::kCmIsOperational
Suspending SNMP Thread
0x00005d34 [CmDocsisCtlThread] BcmVendorCmApplication::StopDhcpServer: (VendorE
xtension CmApp) Shutting down DHCP Server...
0x00005d34 [CmDocsisCtlThread] BcmStandbySwitchThread::CmIsOperational: (Motoro
la Standby Switch Thread) Simulating a press of the standby switch to get the st
ate configured properly.
0x00005d5c [IGMP Thread] BcmIgmpThread::Starting Igmp Thread...: (IGMP Thread)
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread::ThreadMain:
(Motorola Standby Switch Thread) Standby switch was pressed!
0x00005d5c [Motorola Standby Switch Thread] BcmStandbySwitchThread:TonguerocessSwitc
hEvent: (Motorola Standby Switch Thread) Standby switch disabled in nonvol; ign
oring event.
Not logging event ID 2291949524, control for level 7 is 0.
Not logging event ID 2291949324, control for level 7 is 0.
SB5102 CM Event Log w/ BRCM Factory Support sending deferred async messages...
Done w/ deferred msgs
Not logging event ID 2296948624, control for level 7 is 0.
CM>

The modem is able to surf but drops a huge amt of packets
also if i plug both modems on at the same time both constantly restarts, i suspect this is because it is using the same mac. I did a scan and obtained some macs but when i change the mac, it restarts constantly but my "legal" modem stays on.

Can any one help or point me in the right direction
Reply
#2
you can't used the same mac at the same time, what area you from or the isp?
Reply
#3
Fix these..

TLV-11[1]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.2.0 -> 0 (i32) UNKNOWN, ignoring.
TLV-11[2]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.3.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[3]: 1.3.6.1.4.1.4115.10.1.20.0 -> 9339 (i32) UNKNOWN, ignoring.
TLV-11[4]: 1.3.6.1.4.1.4115.1.3.1.1.2.3.5.4.0 -> 3 (i32) UNKNOWN, ignoring.
TLV-11[5]: 1.3.6.1.4.1.4115.1.3.1.1.1.1.0 -> 3 (i32) UNKNOWN, ignoring.
Knowledge=Power
Reply


Forum Jump:


Users browsing this thread: 2 Guest(s)