Blackfrancis
join:2002-12-16
Beaverton, OR
| reply to apilosov
Re: NYC/DirecTV Broadband Gateway reprogramming
I have a hint and an offer:
Hint: If you have an X2 try this: kill power to GW, hold paperclip in the hole in the back and repower... remove paperclip and put back in.. you should see a solid green power light and no status light.. this is called bootloader mode.. this should allow you access from the LAN side (10.5.1.2).. not sure what you would need further than that (but definately something).. now to the offer:
If you want in a few days I can post a sample of the output from the DTV cachefarm (the server where all the modem configs live).. any takers? or would you even find this useful? |
|
speed_change
join:2001-08-20
Saint Augustine, FL | post as much as you can, i'm sure the info will not go to waste. |
|
apilosov
join:2002-12-27
Forest Hills, NY
| reply to DSLTech
I've thought about doing this (buying DTV's info, etc), but really, once I get manufacturer's stock and whatever leftovers DTV had, I'll need to pay through the nose for more modems. And I don't want to go bankrupt on that, like DTV had 
DTV modems are useful to customers who already have them. There's no point in trying to build an ISP based on DTV's modems. |
|
bhan261
join:2001-02-12
New York, NY | reply to apilosov
Re: http://cfcityname.directvdsl.com output
Did you ever get this? I have a printout of my X2 I can fax you. |
|
apilosov
join:2002-12-27
Forest Hills, NY | Yes I have all the cfcityname output... |
|
zarsky99
join:2002-05-30
Ballwin, MO
| Hey just a note to everyone working in this thread...someone post on this thread that DTV will be releasing HW and programming details once the company fully implodes.
»Linux or a RTOS on the gateway? |
|
apilosov
join:2002-12-27
Forest Hills, NY | I strongly doubt it, I have a feeling that either the tech or the person who asked the question misunderstood something.
I've never happened to hear of a company releasing details of embedded hardware before its death. |
|
tstretch
@floridadigital.net
| reply to halfempty
Re: NYC/DirecTV Broadband Gateway reprogramming
I am an engineer with Florida Digital Network trying to find a way for our ADSL customer's who have recently switched to us from DTV to use their existing modems. I would be willing to help in any way I can if it is of assistance. Let me know if I can do anything.
tallen@FloridaDigital.net |
|
tstretch
join:2003-01-13
Jacksonville, FL
|  reply to apilosov
I am an engineer with Florida Digital Network (Florida ISP) trying to find a way for our ADSL customer's who've recently switched to us from DTV to use their existing modems. I would be willing to help in any way I can if it is of assistance. Let me know if I can do anything.
tallen@FloridaDigital.net |
|
Blackfrancis
join:2002-12-16
Beaverton, OR
| reply to Blackfrancis
here you go.. i edited out the specific customer info.. this is all the information that the directv cachefarm dumps into the GW upon initial configuration download..
hope it helps.
"ModemId=xxxxxx", "DSLPhoneNumber=xxxxxxxxx", "CFG.UpdateTime=2002/12/17-13:21:04", "CFG.UpdateNumber=2", "DHCPMaxLease=86400", "DHCPDefaultLease=86400", "DSLNetwork=xx.xx.xx.xx", "DSLNetworkBits=30", "LANNetwork=xx.xx.xx.xx", "LANNetworkBits=30", "InterfaceCount=1", "DryCopper=N", "MeteringFrequencySeconds=3600", "DNSCachingServer=1.1.1.1", "HTTPCachingServer=1.1.1.1", "FTPCachingServer=1.1.1.1", "SNMPGetPwd=public", "DNSServer1=xxx.xxx.xxx.xxx", "DNSServer2=xxx.xxx.xxx.xxx", "TimeOffGMT=-28800", "ModemAdminLogin=admin", "ModemAdminPassword=xxxxxxx", "SNTP1=xxx.xxx.xxx.xxx", "SNTP2=xx.xx.xx.xx", "SNTP3=xxx.xxx.xxx.xxx", "DHCPEnable=true", "DNSEnable=true", "SNMPEnable=true", "HTTPRedirEnable=false", "FTPRedirEnable=false", "ImageServer1=cf(popname).telocity.com", "ImageServer1Port=80", "ImageServer1URI=/ModemConfiguration/TargetUpdates/getlatestupdate.asp", "ImageServer2=cf(popname).telocity.com", "ImageServer2Port=80", "ImageServer2URI=/ModemConfiguration/TargetUpdates/getlatestupdate.asp", "InetNode1=velocityport.whoosh.com", "ManNode=xxx.xxx.xxx.xxx", "DCNode=xxx.telocity.com", "ImageServerLogInName=admin", "ImageServerPassword=pass", "InetNode2=velocityport.whoosh.com", "InetNode3=velocityport.whoosh.com", "RoutableInterface=Ethernet", "CBQ1=", "CBQ2=", "CBQ3=", "CBQ4=", "Manager1=xxx.xxx.xxx.xxx", "Manager1MaskBits=21", "Manager2=xxx.xxx.xxx.xxx", "Manager2MaskBits=22", "Manager3=xxx.xxx.xxx.xxx", "Manager3MaskBits=24", "Manager4=", "Manager4MaskBits=", "Manager5=", "Manager5MaskBits=", "Basic_NAT_Provisioned=ON", "Basic_NAT_Setting=ON", "Basic_Firewall_Provisioned=ON", "Basic_Firewall_Setting=ON", "BasicALTQControl=272", "LACDomainName="
fyi - if you see an "x" value that my edit.. there was an IP there previously, and the cf(popname) value should be using the actual pop name e.g. cfmdw.telocity.com (thats ficticious) this should at least present the format and order that the config is presented to the modem in.. also i suspect that dtv might kill this post, so you might want to save it.. good luck. |
|
mjf
" "
Premium,Mod
join:2000-08-05
New Orleans, LA
clubs:
 ·AT&T Southeast
Host:
General Questions
Wireless Networking
Covad / covad.net
D-Link
Difficult Searches..
| Boy you did a lot of editing. I sent him my dump via IM a while ago and only edited out my phone number.
At least it shows everyone what is contained in the "mystery" file.
--
Join Team Discovery mjf@dslr.net |
|
Blackfrancis
join:2002-12-16
Beaverton, OR | yeah well.. thats from an active customer and even though DTV may not be overly concerned about its employees, I still have some ethical concerns.. sorry if that diminished its effectiveness. |
|
wmcbrine
Touched by His Noodly Appendage
join:2002-12-30
Laurel, MD
| I emailed him, and I didn't even edit out my phone number. I'm about to shut that line down anyway.
I didn't really see what abuse it could be subject to. I don't think you can actually use that info without being connected to the right DSLAM port. |
|
apilosov
join:2002-12-27
Forest Hills, NY
| reply to apilosov
Actually current stumbling block is not the cfcityname, its
the
»xxx/referral/findmetrooffice.asp···e=wellex
It expects to get a string "nyc" or something like that, apparently, but I'm not sure what should be the key:
"MetroOffice=nyc" or something like that, I'd assume.
If you can run sniffs around the cachefarm, and you know the correct output, give me a shout. |
|
Blackfrancis
join:2002-12-16
Beaverton, OR
| reply to wmcbrine
indeed not, but since it had the IP addy and the admin password of an active customer I had to get rid of it. Its not so much a question of using this information to surf or whatnot, but rather to mess with this guys connection... at any rate necessary or not I felt it was better to be safe than sorry. |
|
paul_randall
@optonline.net
| reply to apilosov
I have recently started in on this project. I have discovered ( I think ) that the X202 is based on the Alcatel Dynamite Chipset ( as it is labeled on the chip). that did not help me much except that a similar chipset is on the Alcatel A1000. I downloaded the user guide to this and the CLI guide. It seems similar to what I have experienced with the X202. The CLI (Command Line Interface) is of particular interest to me. Also, there is a guy out there that says the 9 Pin Mini-Din can be used for a serial connection. He says it is a Mac style null modem situation. So you have to hack the cable a little. He goes through a process to obtain the password. Unfortunately I think he talking about the X101 or X301(?) because my modem does not have that port.
The next thing I learned was that the modem is running WindWeb 1.1 So I went to their web site: www.windriver.com I found that WindWeb runs on top of vxWorks. Wind River sells the development tools. Apparently one of the ports on the x202 is a debug port, I think this can loosely translate to rs232. I have tried to use this as a serial connection with no luck. I used the Mac to Db9 pinout with no luck.
I have never hacked any hardware before so I don't know if any of this is usefull or not. |
|
justbits
More fiber than ATT can handle
Premium
join:2003-01-08
Chicago, IL
·AT&T Midwest
|  reply to Blackfrancis
With some creative URL guessing, you can view this URL:
htp://cf(popname).telocity.com/ModemConfiguration/TargetUpdates/getlatestupdate.asp?DSLPhoneNumber=1112223333
Where (popname) is your POP city name.
Where 1112223333 is your phone number.
This URL spat out:
"serveraddress=cf(popname).telocity.com", "serverport=80", "serveruri=/modemconfiguration/downloads/<firmware-version>.base.udp"
This partial URI can be turned into a URL from which you can download your modem's firmware (for archival purposes only!) 
htp://cf(popname).telocity.com/modemconfiguration/downloads/<firmware-version>.base.udp
<firmware-version> is made up of the Software/Target Version on the Advanced Info page and an embedded letter. If Target Version is "X2S-3-42.19.YYYYMMDDHHMM", the download was "x2sdsl-3-42.Q.19.YYYYMMDDHHMM.base.udp". (This was for a X2 SDSL modem.)
Anyone know any other URL's that provide useful information?!!! |
|
foxsteve
Premium
join:2001-12-28
Campbell, CA | What is (popname) for San Jose, Santa Clara county, CA? |
|
justbits
More fiber than ATT can handle
Premium
join:2003-01-08
Chicago, IL
·AT&T Midwest
| I don't know. Here are a few of the cf server names.
cfatlanta.telocity.com
cfchicago.telocity.com
cfdallas.telocity.com
cfmiami.telocity.com
cfdc.telocity.com
cfne.telocity.com
cfpw.telocity.com
sjc is a common telocity shortname, but cfsjc doesn't exist. |
|
paul_randall
@nac.net
| reply to apilosov
I found some doco on the chipset for the TElocity X202. It is here:
»www.alphamicro.net/resource/MTK2···9905.pdf
The Main chip is part of the "Modem Toolkit" (?) I am guessing at that. Let me know if it is usefull. I saved off a copy in case it is usefull. Also, I want to note that both my other modems are Alcatel chipsets, one is a ZyXel Modem and the other is a Westell.
If you go to the Alcatel website you can dowload userguides and CLI (Command Line Interface) for the A1000, I know my ZyXel uses this set of commands because I can access them. I believe the Telocity does as well. |
|
