dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
13512
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

NYC/DirecTV Broadband Gateway reprogramming

I'm trying to develop instructions for reprogramming Telocity/DirecTV modem for "any provider". I already have a few ideas, but need access to more modems to confirm that it works.

If you are in NYC area, and don't mind donating your modem to science (I will pick it up but I won't issue you a receipt ), get back to alex@pilosoft.com

Also, if there are any DTV DSL customers with still-working service, I'd like to test a few things on your working modem, preferably on Sunday.

Please get back to me if you'd like to help, and let me know what kind of modem do you have ("brick"/X1/X2), and whether do you still have DTV DSL service.

I promise to share results here, if successful.

Thanks,
-alex (alex@pilosoft.com)
NutBucket
join:2002-07-26
Los Angeles, CA

NutBucket

Member

I noticed some nice connectors on the brick's board that would appear to let one reprogram the FPGA that's in there. That could make something happen:-P
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

Much simpler.

When you boot it up with a serial port attached to it and a paper clip in a "reboot" position, it dumps all configuration traffic in/out, which should make it possible to create a new "configuration server" to imitate DTV.

-alex
SilentTech
join:2002-12-08
USA

SilentTech

Member

When you paperclip to erase the configuration, the gateway will wait for you to enter your DSL phone number at »10.5.1.2/ and this is used to look up your account in Telocity's database (over HTTP), which redirects the gateway to a cache server, from which the gateway downloads its configuration (also over HTTP). Unless you're in VerizonEast (formerly BellAtlantic, not GTE) or Ameritech territory (and not going through WorldCom), the gateway will actually send out a DHCP request the first time it is powered up with no configuration, and get its IP (the IP for the WAN interface, which we call the "DSLIP", pronounced "D-slip"). It also gets the LAN subnet information, via a vendor-specific option in the DHCP protocol. Apparently the Nortel Shasta router figures out where the DHCP request is coming from (based on VPI/VCI/slot/port) and adds that information to the DHCP query before passing the query on to the DHCP server. The DHCP server is able to use that information to find your account and assign the gateway the correct IP information, but the gateway won't use this for routing until the configuration is downloaded.

Ameritech uses PPPoE which works completely differently, and VerizonEast uses aggregate routing so the Shasta can't figure out who you are until you enter your phone number (that's why you get a blinking red status light - that indicates a DHCP failure). When you enter the DSL#, that is added to the DHCP request, and the request is sent again. Once the gateway has the DSL# and IP information (from DHCP), it does the HTTP download to get its configuration, and never does a DHCP request again.

The tricky part about what you're thinking of is, the DHCP request and HTTP download happen on the WAN interface, meaning the DHCP and HTTP servers have to be on the other side of a DSL connection. I've heard it's possible to get two DSL modems to sync to each other on a dry copper pair, meaning you could get a standard DSL modem acting as an Ethernet bridge, and connect it to the DirecTV DSL gateway via a phone line, but I don't know if this actually works.

I hope this information is helpful!
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

You are absolutely correct as far as protocols, but I just want to make sure that the protocols are not different between "brick"/X1/X2.

Also, it is not possible to get sync on dry copper, DMT can't do that.

Again, I want to make a user-friendly way to reprogram the modems, for which I'd like to have access to all different modems...
apilosov

apilosov

Member

30$ for the modem, if you are in NYC!

Well, seeing less than enthusiastic response, how about a bounty?

I'll pay 30$ cash to first 10 people in NYC with DTV DSL Broadband Gateway who get back to me today or tomorrow, and agree for modem pickup.

(Sorry, no mail, since the I need the modems by tomorrow)

Please get back to alex@pilosoft.com, and state what kind of modem do you have, and how you can be reached.

Thanks.

ass_kicker_9
Carmen Electra, Damn She's Hot
join:2002-03-12
San Jose, CA

ass_kicker_9 to apilosov

Member

to apilosov

Re: NYC/DirecTV Broadband Gateway reprogramming

do you have enough yet, i would donate mine, but i am in cali, please post back with the results and if we can reprogram them or not.
mudgie
join:2002-10-28
North Aurora, IL

mudgie to apilosov

Member

to apilosov
I'll follow this thread, seems like there might be a science project here.

I have an SDSL brick, vintage 1/2000.
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

Strangely enough, so far, I only got one, an old "brick".

So, if you are in NYC and want to make quick 30$, let me know.

-alex

SMCinAZ
Premium Member
join:2000-11-29
Glendale, AZ

SMCinAZ to apilosov

Premium Member

to apilosov
I'd pay good money to know how to reprogram one to work on regular ADSL. I have 3!
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

Well, here's the thing:

You can't program the modem from CPE side. You can only program it from service provider side of the line.

I know enough about modem-gateway protocol to be able to program the modems. Since I run an ISP, I am able to do that (by running certain services on my side).

Unfortunately, at home you can't duplicate this, you need a cooperating provider...
fastasican
join:2001-07-08
Atlanta, GA

fastasican

Member

r you sure you can not reprogram the modem on the CPE (sorry, don't know what CPE stands for but I have deduced that you are talking about the end-user side of the modem) any way at one time I had found a hack that allowed one to change the modem config so that I could move from USB to Ethernet after several calls to DTVDSL customer Dis-service produced little result. I appeared that all the modem's parameters could be changed from the web interface. Would you like me to dig up the output and information on my modem or would I be wasting your time?

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

said by fastasican:
.... any way at one time I had found a hack that allowed one to change the modem config so that I could move from USB to Ethernet after several calls to DTVDSL customer Dis-service produced little result. I appeared that all the modem's parameters could be changed from the web interface. Would you like me to dig up the output and information on my modem or would I be wasting your time?
All you got was the admin password for your modem, and the URL to the Admin functions page.

That allows you do do a few things such as switch the routed interface back and forth between USB, ethernet, or parallel (if your modem has that port), reboot the modem, and clear and re-download the configuration.

There is nothing in the available Admin function pages that allows arbitrary reprogramming of the modem.

And the password for your modem will not work with someone else's modem.

djrobx
Premium Member
join:2000-05-31
Reno, NV

djrobx to apilosov

Premium Member

to apilosov
CPE = Customer Premesis Equipment

Dammit2
@attbi.com

Dammit2

Anon

This is just another former DTV tech posting his 10 cents on this subject. I am pretty sure without totally erasing and rebuilding the firmware/Software from nothing. You are wasting your time. I will give you a little hints. The X2 has 2 images of the firmware in the modem. Make sure you get them both erased otherwise the modem is programed to copy the second back to the first after it is erased.

Dammit

bhan261
join:2001-02-12
New York, NY

bhan261

Member

sneaky bastards!

wmcbrine
join:2002-12-30
Laurel, MD

wmcbrine to apilosov

Member

to apilosov
I could see loaning them, but not donating them. This is how I look at it: The reason someone might want to give you one is so that you can learn to reprogram the modems in general, thus giving them value after DirecTV folds. A fine goal. But if you succeed, then everyone who kept their modems gets the benefit, while those who donated lose it! Meanwhile, those who don't care whether the project succeeds or not -- and thus don't care if they get their modems back -- won't bother donating, because it's too much effort.

I think you'd get a better response if you promised to return the modems after testing. You probably can't guarantee you'll return them in working order, but that's OK. You can even ask people to include return postage when they send the modem if they want it back. I suspect that would work better than the $30 bounty. (After all, if this does work, then the modem is worth more than that.)

SMCinAZ
Premium Member
join:2000-11-29
Glendale, AZ

SMCinAZ to apilosov

Premium Member

to apilosov
Like I said, I have 3. I would gladly donate an X-1 to the cause if shipping was paid for and if I was kept in the loop of info.
apilosov
join:2002-12-27
Forest Hills, NY

apilosov to Dammit2

Member

to Dammit2
You missed the point. I'm not reprogramming new firmware into the modem. I'm creating a replica of DTV configuration server for ISP to run, so unaltered modems can pick up configuration.

If you can contribute more precise protocol description for HTTP-based config protocol, or a dump of HTTP traffic session from modem to gateway, it would be appreciated
apilosov

apilosov to wmcbrine

Member

to wmcbrine
OK, how about this:

a) I will return the modem after reprogramming it to your favorite ISP's settings.

b) Alternatively, I'll 3 give months of free DSL service to first 5 people with X1 modem who contact me (if you are in NYC/LongIsland/North Jersey). Note, ONLY X1, I have X2 modems and they lack serial port needed to debug things...

halfempty
join:2001-04-28
Miami, FL

halfempty to apilosov

Member

to apilosov
said by apilosov:
If you can contribute more precise protocol description for HTTP-based config protocol, or a dump of HTTP traffic session from modem to gateway, it would be appreciated
Another thing to consider is if the modem side can be set to bridge mode without re-flashing the firmware. Currently the gateway gets one IP on the WAN side, then a .252 on the LAN side. In my case both sets are routable. I think they are/were the only ISP to do this.
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

Most likely its not able to do pure bridging. As I previously said, ISP's cooperation will be necessary to get these modems working with any ISP...
apilosov

apilosov

Member

http://cfcityname.directvdsl.com output

Hi,

If anyone has _complete_ output from »cfcityname.directvdsl.com?.... (obtained back in the day when these servers were open), I'd love to get my hands on that.

You can obscure your password...

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf to halfempty

MVM

to halfempty

Re: NYC/DirecTV Broadband Gateway reprogramming

No, anyone selling RFC1483 routed service can do it this way. I have a .248 LAN behind a single WAN IP on my EF 5660 in RFC1483R mode.

What was a bit different with DTV is that they do this on RFC1483 bridged service, not routed service. That is to say, you can yank out their gateway, replace it with a bridge, and the result can be used to recover and use all four of the /30 IPs as well as the LAN IP if it's public.
[text was edited by author 2003-01-02 13:34:32]
graysonf

graysonf to apilosov

MVM

to apilosov

Re: http://cfcityname.directvdsl.com output

Assuming those cf servers are still operating, and you can insert an ATM sniffer on the line, you should be able to see what you are looking for by reloading the configuration from the server. But of course you would need to be a DTV customer.
apilosov
join:2002-12-27
Forest Hills, NY

apilosov

Member

Well, these DSL sniffers are very very expensive, and hard to find. Which is why I'm asking if anyone has a saved output from a config server.

mjf
MVM,
join:2000-08-05
New Orleans, LA

mjf

MVM,

Check your IM. I just sent it to you. Good Luck.

From the old X1 brick.
twodogs
join:2001-08-17
Pahrump, NV

twodogs to apilosov

Member

to apilosov
Alex, I email you a copy....
apilosov
join:2002-12-27
Forest Hills, NY

apilosov to graysonf

Member

to graysonf

Re: NYC/DirecTV Broadband Gateway reprogramming

Correct, you can use a standard modem with DTV service, but you can't use DTV's modem with any ISP that doesn't do routing DTV's way (/30 for "point-to-point" and /30 for LAN)...

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

It's /24 for WAN and /30 for LAN.

You may want to look thru the recent posts here. There was an ISP who, as part of their pitch to transition DTV customers, claimed they could re-use the DTV modems. However, they could not pull this off in the end, but supposedly managed to get inside them to some degree before deciding they were unsuitable.

Perhaps they will share notes with you.