dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
7052
share rss forum feed


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Reviews:
·Knology

New SB6120 Firmware

I noticed during a modem reboot this morning that a firmware update was being applied. Can our new WOW overlords let us know whats been changed/fixed with the firmware? One thing I've noticed is a new open source page.

I've been running the out of box firmware up to this point.

Model Name: SB6120
Vendor Name: Motorola
Firmware Name: SB_KOMODO-1.0.6.10-SCM00-NOSH
Boot Version: PSPU-Boot 1.0.0.4m1
Hardware Version: 3.0
Serial Number:
Firmware Build Time: Oct 29 2012 18:07:13


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
From what I've gathered, the main fix in that firmware is for an issue with some older modems constantly rebooting with certain config files. We had issues with them when launching DOCSIS 3.0 a couple years back, and we had to update all the 6120/6121 modems to a newer firmware to correct it. We've done this preemptively to keep from having issues with any config file changes that may happen in the future.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1

1 edit
reply to BiGdUsTy
The link light is non stop blinking now after the update. I bet if I start up Wireshark i'll find a ARP broadcast packet storm going on. I had this same problem after the new Arris C4 CMTS was installed last year.


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
Reviews:
·Knology
Hey Dusty. I have the same. I just upgraded to "the edge" 2 days ago & when I rebooted, I had the new firmware. I thought it was because of the upgrade.

But I too have a non-stop blinking activity light. I isolated all my connected devices trying to see which one was causing it but it seems it is ARP traffic.

Now I have it blinking at me constantly as it sits on my desk!

Blink... blink... blink... blink...
--
Certified Jenius!


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
said by goober22:

Hey Dusty. I have the same. I just upgraded to "the edge" 2 days ago & when I rebooted, I had the new firmware. I thought it was because of the upgrade.

But I too have a non-stop blinking activity light. I isolated all my connected devices trying to see which one was causing it but it seems it is ARP traffic.

Now I have it blinking at me constantly as it sits on my desk!

Blink... blink... blink... blink...

Could you guys send me the HFC MAC addresses of your modems in a private message so I can take a closer look at the modems?
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
PM sent Dan.


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
reply to BiGdUsTy
Initial testing appears to show this as an intentional change from Motorola through firmware. It appears the link light now flashes regardless of activity, to show that there's a connection on the Ethernet side of the modem. We tested this with a modem in the lab, and regardless of if we were using the connection or not, it would always flash.

Even when the computer was booted, and hadn't even posted yet, the light would flash. To me, this would mean the light is designed to flash when it has a connection. This also resembled the same activity all of our other modems displayed. We tested a couple Arris, Cisco and Motorola modems, and they all displayed the same thing.

I also tested this with Windows 7, 8, Linux and OSX, and all exhibited the same behavior when plugged into the modem. I did this to rule out different operating systems creating different results.

Could you possibly take a look with a packet capture and see if you see anything on your network that is actually an issue? Right now, I'm thinking this was just an intention change in behavior by Motorola to be in line with other modem normal operation.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Reviews:
·Knology
It's an ARP storm just as I suspected it would be. This is a small snapshot of the traffic from the modem connected directly to my PC. I could post the full log of a minute run but it would take pages to post. Some of these are the private modem IP's and others are the public IP's. This is a nasty mess on the network that needs to be cleaned up.

3649 77.234807000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.12.70? Tell 10.141.0.1
3650 77.236557000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.17.185? Tell 10.141.0.1
3651 77.238808000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.157? Tell 10.141.0.1
3652 77.289304000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.176? Tell 10.141.0.1
3653 77.322669000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.7.40? Tell 10.141.0.1
3654 77.346102000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.171? Tell 10.141.0.1
3655 77.398608000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.135? Tell 10.141.0.1
3656 77.475080000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.23.129? Tell 10.141.0.1
3657 77.498815000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.9.111? Tell 10.141.0.1
3658 77.517121000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.131? Tell 10.141.0.1
3659 77.522550000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.199? Tell 10.141.0.1
3660 77.548708000 Cadant_39:4e:41 Broadcast ARP 60 Who has 69.73.44.120? Tell 69.73.44.1
3661 77.549710000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.13.61? Tell 10.141.0.1
3662 77.597904000 Cadant_39:4e:41 Broadcast ARP 60 Who has 24.214.228.242? Tell 24.214.228.1
3663 77.604058000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.159? Tell 10.141.0.1
3664 77.614086000 Cadant_39:4e:41 Broadcast ARP 60 Who has 69.1.42.36? Tell 69.1.42.1
3665 77.629843000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.145? Tell 10.141.0.1
3666 77.647075000 Cadant_39:4e:41 Broadcast ARP 60 Who has 207.98.206.188? Tell 207.98.206.185
3667 77.655529000 Cadant_39:4e:41 Broadcast ARP 60 Who has 24.96.43.102? Tell 24.96.43.1
3668 77.659655000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.8.152? Tell 10.141.0.1
3669 77.670160000 Cadant_39:4e:41 Broadcast ARP 60 Who has 75.76.150.133? Tell 75.76.150.1
3670 77.684566000 Cadant_39:4e:41 Broadcast ARP 60 Who has 10.141.18.26? Tell 10.141.0.136


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
And you were not seeing these ARP requests before the firmware upgrade?


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Nothing but your normal background noise like port scanners, worms etc. Like I said above the last time this happened was after the CMTS upgrade for docsis 3. That ARP request flood lasted for a good month or more.


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
Nothing was changed on the CMTS side, that's been the same for months. I will talk a little more with the provisioning group and see if they can figure out why this changed with the new firmware.


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
Can you give me the specifics about what you're doing when you gather this information? What software you're using, what devices you're hooked up to, etc. I want to try and test this exactly the same way as you, on both versions of firmware to see if I can duplicate the results.


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Reviews:
·Knology
SB6120 connected directly to my PC's gigabit ethernet port. I use Wireshark 1.8.5 to look at and log all incoming and outgoing packets on that interface.



This is running on Windows 7 SP1 x64 with Wireshark x64 (wireshark.org)


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Reviews:
·Knology
reply to WOW_Dan
I don't really see how a firmware update to a modem can cause this kind of ARP flooding but it has exposed it that's for sure. I'd say that some piece of equipment has been misconfigured or installed with out proper configuration to begin with. One thing that needs looking into is what type of protocol filtering is being done. Specifically layer 3 protocol filtering in the routers and switches that make up the network.

It's possible that an anomaly triggered this flood but more than likely it's a misconfiguration in a router or switch somewhere. If goober and I both can see this flood from different hubs and nodes then all of the panama city system is to.


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
Reviews:
·Knology
Click for full size
Here is a small sample from me. I only ran it 10 seconds and got plenty of hits. I'm on the city side of Panama City in Cedar Grove. Dusty is out on the beach side in PC Beach.

This is a SB6120 connected directly to my PC running Win7 SP1 x64.
--
Certified Jenius!


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
reply to BiGdUsTy
said by BiGdUsTy:

I don't really see how a firmware update to a modem can cause this kind of ARP flooding but it has exposed it that's for sure. I'd say that some piece of equipment has been misconfigured or installed with out proper configuration to begin with. One thing that needs looking into is what type of protocol filtering is being done. Specifically layer 3 protocol filtering in the routers and switches that make up the network.

It's possible that an anomaly triggered this flood but more than likely it's a misconfiguration in a router or switch somewhere. If goober and I both can see this flood from different hubs and nodes then all of the panama city system is to.

The ARP requests themselves have always been there. It's a normal situation when you're on on an RF network. There's a single path all requests have to go out, therefor all modems will see the events. I would expect you to see these messages if you look for them. What I was trying to narrow down is why you are seeing them now and not previously. I was going to attempt to see if there was a difference with the old firmware vs the new, and wanted to most accurately duplicate your situation.

We do provision all of our HSD packages at 10% higher than your package speed to ensure this overhead does not put your speed below what you're paying for.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
So without a filtering solution for this Goober and I should buy lots of rolls of electrical tape?

I'd love to see what the cpu utilization is on the cmts for ARP input.


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
said by BiGdUsTy:

So without a filtering solution for this Goober and I should buy lots of rolls of electrical tape?

I'd love to see what the cpu utilization is on the cmts for ARP input.

While it is the highest CPU utilization process on the CMTS, it only accounts for ~6% CPU utilization time. The CPU idle process has ~86%, if that gives you some perspective. I'm not sure why the Motorola modems acted different previously, but this is a normal occurence on every other modem I've tested with. I have about 20 modems in a test rack and I plugged into each one and got the same results. The best way to block this traffic from being seen on your LAN would be with a firewall. I do not predict there will be a way to change the blinking of the LED, at least from our side. That would most likely be a question for Motorola to answer. I'm working on setting up a way to test this on the older firmware.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
Click for full size
I downgraded our 6120 to an out of the box firmware it had when we got the modem, which was SB6120-1.0.1.8-SCM02-NOSH. This did slightly change the behavior of the link light, it would blink or stay solid depending on activity, but it did not change the fact that you can see the ARP requests through a packet capture. This is perfectly normal, lifehacker even wrote a good article about the blinking light question - »lifehacker.com/5979481/why-does-···internet

The main issue with this older firmware was very obvious once we loaded it on the modem, as the modem just went into a consistent reboot cycle when we tried to provision it. The only way to get it to come online was to leave it unprovisioned, and adjust unprovisioned configuration file to allow the modem to pass information. This is how I was able to test and do a packet capture on the older firmware version. Using the previous version of firmware you had is not going to be an option down the line, as your modem would get stuck in that reboot cycle I mentioned earlier, with no way to use it unless the firmware was upgraded.

If you do a quick google search, you can find plenty of people that have experienced this problem, including someone here in the Knology forums a few years back (»SB6120 Firmware). Previously Knology had multiple provisioning systems, which could explain why some markets would experience issues while others did not (this has already been fixed in almost all Knology markets).

Long story short, the ARP requests you see are completely normal on a cable system, and without a firewall on your network, you won't be able to block them. The firmware update was a required step needed to launch faster DOCSIS 3.0 internet speed packages without customer modems crashing and rebooting, due to a well known bug in older Motorola firmware.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
Reviews:
·Knology
Dan, it seems like then the solution is to talk to the Motorola engineers and have them have the units ignore the background traffic instead of passing it out as customer activity. Background traffic should not be causing the unit to flash active activity 24/7.

A concerned person may think someone is on their connection illegally doing "who knows what".

But seriously, the older firmware did not report it so it should be an easy fix to have the latest do the same. It should simply be solid light for connection and flashing for user activity. Behind the scenes, normal traffic should not be flash worthy. Maybe Moto can help.
--
Certified Jenius!


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
reply to WOW_Dan
»www.cisco.com/en/US/docs/cable/c···pfl.html

I would think Arris offers the same for there cmts but maybe not?


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
said by BiGdUsTy:

»www.cisco.com/en/US/docs/cable/c···pfl.html

I would think Arris offers the same for there cmts but maybe not?

That feature is to restrict ARP storms from affecting the service on the CMTS. It will filter out excessive ARP requests at the CMTS if a modem is sending out more than allowed. Arris C4's refer to it as "ARP Throttling". This will not change whether or not you see this information. All it does is keep someone from attacking the CMTS via ARP storms.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


BiGdUsTy

join:2005-10-20
Panama City Beach, FL
kudos:1
Electrical tape over the blinking led of doom and jump in line with the rest of the sheep. Sounds like a good plan!


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
Reviews:
·Knology
reply to WOW_Dan
The point isn't to remove it from the traffic stream but to prevent it from making the link/activity light flash constantly. It did not do it with the old firmware but does now with the new one.

Otherwise, what is the point of an activity light if it's always flashing on background noise?

Should be:
Off = no connection
On = connection
Flash = customer activity

But, I guess I'm with Dusty. I'll "fix" my high tech device and it's constant flashing with a piece of electrical tape.
--
Certified Jenius!


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
said by goober22:

The point isn't to remove it from the traffic stream but to prevent it from making the link/activity light flash constantly. It did not do it with the old firmware but does now with the new one.

Otherwise, what is the point of an activity light if it's always flashing on background noise?

Should be:
Off = no connection
On = connection
Flash = customer activity

But, I guess I'm with Dusty. I'll "fix" my high tech device and it's constant flashing with a piece of electrical tape.

I apologize that the firmware update changed the behavior of the modem, but that's not something we here can control. We only push out the firmware Motorola creates for these modems. If there would be anyone that could do anything with your issues, it would be Motorola. They might be able to provide more information on why this was changed.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer


goober22
Resident Duh-Huh Member

join:2001-12-28
Panama City, FL
kudos:1
Reviews:
·Knology
I understand and I'm not dumping on you Dan but that was what I suggested earlier. Maybe WOW/Knology would contact the Motorola folks and explain the customer complaints you have been getting over it. Maybe they'll work it into the next firmware upgrade. Since we users can't upgrade the firmware ourselves, it'll take you to make the issue known to Motorola.
--
Certified Jenius!


WOW_Dan
Premium
join:2011-03-24
Naperville, IL
kudos:35
said by goober22:

I understand and I'm not dumping on you Dan but that was what I suggested earlier. Maybe WOW/Knology would contact the Motorola folks and explain the customer complaints you have been getting over it. Maybe they'll work it into the next firmware upgrade. Since we users can't upgrade the firmware ourselves, it'll take you to make the issue known to Motorola.

I will mention it to the provisioning group to see if they can pass the along to Motorola. I don't have any contacts with them personally.
--
Dan Della Terza
WOW! Internet, Cable & Phone
CMTS Operations Engineer