Verizon DSL → telnet into fujitsu modems?

Whoa, now this is interesting. I was screwing around last night and found out that if you set your IP to 10.10.207.101 (subnet 255.255.255.0) you can actually telnet into your modem! The IP to telnet into is 10.10.207.100. I have confirmed that this does indeed work with several different RA14 Issue 2 modems as well as an RA12. The password appears to be "password" on all the modems I have tried.

Figure 1:

password:
logged on; type `@close' to close connection.
10.10.207.100> help

Commands are:

atm            bppt           bridge         buffer         bun
chips          config         edd            ethernet       event
flashfs        ip             isfs           noprintfs      portcli
restart        snmp           tftp           uptime         version
wdog

  '.'        repeats the last command
Type 'help all' or 'help ' for more details

10.10.207.100>

I also noticed if you sync your modem up while logged in the line stats will appear too.

Figure 2:

Modem 0...
Startup mode : ADSL1 startup
tone_range_up ( 7 , 30 )
tone_range_down ( 31 , 255 )
tx_atten (AFE,scalar) 0 1
agc down 26 up 0
ref_atten -65.9800033569336 - This appears to be the attenuation +40.
noise_margin down 34.599998474121094 up 9
net fast rate_kbps down 0 up 0
net interleave rate_kbps down 1536 up 768
bruto fast rate_kbps down 96 up 96
bruto interleave rate_kbps down 1760 up 928
max_rate_kbps bruto ( not include redundancy ) down 9956 up  1096
max_rate_kbps net down 9828 up  1000 - Max possible line rate.
interleave dep 'D' down 4 up  4
interleave frames per cw 'S' down 4 up  4 ( 0 means s=1/2 )
fast redundancy per frame down 2 up  2
interleave redundancy per frame down 4 up  3
bit swap enable status 1
SEF tones (32 52) threshold 4
End of startup (modem 0)

This is really quite interesting to me, and just thought I'd share. I'm not sure what you can do, but I am looking around at stuff. Any comments about this?
I always thought you couldn't get into Fujitsu Speedport modems :D

Edit: Darn typos :(

[text was edited by author 2001-11-02 09:15:31]

Didn't work for me.

Now if only Westell wasn't so anally retentive and release the method for getting line stats, even with their own utility from their modem... I've been reading the forums here for nearly 9 months, although I registered in the summer, and I keep praying someone will come up with a way to get stats from the Westells ...

Good for you! What model of the Fujitsu are you using? Perhaps thats why it isn't working for Kukuman.

~Anne

(darned spelling!)

[text was edited by author 2001-11-03 03:13:12]

said by Kukuman:

---

Didn't work for me.

---

Hmm, I don't know why. 3 of my friends tried it with their modems (Model: FC9660RA14 Issue 2) and it worked, perhaps you made a typo in the IP or something? If not, I don't know... Are you running a firewall? It could be blocking the connection, I'm running ZoneAlarm Pro and it did that to me... Also, did you remember to set your IP to 10.10.207.101?

Has anybody had success with this?

Edit: stupid typos! now only if i didnt attempt to type at the speed of light...

[text was edited by author 2001-11-03 08:48:52]

I'm in Sarasota, FL, and have the Fujitsu Speedport FC9660RA14. I have the 1.5 down/384 up package with Verizon as line provider and ISP. Prior to telnet'ing, I turned off BlackICE, although I'm not certain that was required.

Here are my results after sync. (I disconnected the phone line to achieve a re-sync--don't know if there was a more elegant way to do this.)

Modem 0...
Startup mode : ADSL1 startup
tone_range_up ( 7 , 30 )
tone_range_down ( 31 , 255 )
tx_atten (AFE,scalar) 0 1
agc down 28 up 0
ref_atten -78.81999969482422
total_rx_power -9.25596411572893e+61
noise_margin down 37.150001525878906 up 2
net fast rate_kbps down 0 up 0
net interleave rate_kbps down 1504 up 384
bruto fast rate_kbps down 96 up 96
bruto interleave rate_kbps down 1728 up 512
max_rate_kbps bruto ( not include redundancy ) down 1696 up 1208
max_rate_kbps net down 1568 up 1112
interleave dep 'D' down 4 up 4
interleave frames per cw 'S' down 4 up 4 ( 0 means s=1/2 )
fast redundancy per frame down 2 up 2
interleave redundancy per frame down 4 up 2
bit swap enable status 1
SEF tones (31 51) threshold 4
End of startup (modem 0)

It sure looks like I'm interleaved as the 'net interleave rate_kbps 1504/384' matches my 1.5/384 provisioning. Anyone know how to get interleaving turned off so I can decrease my latency and thus reduce my ping? Also, it looks like the max I can get down is 1.5 Mbits/sec. I'm at 9100 feet from the CO. Shouldn't I be able to get close to 7 Mbits/sec as a max line rate?

Comments, please!

Ron

You appear to be on a double card on your DSLAM, for some reason it ALWAYS reports 1568 as the max downstream. No idea why... Also it says your upstream noise margin is 2, which is also not true, there's something about double cards that the RA14 and RA14 Iss. 2 modems don't like. But with your current sync rate being 1504 and noise margin being 37, your line should be clean for 7 megs. If you were by any chance to get the 7 meg package from Verizon (yes, they do have it in ex-GTE land, just have to go with an ISP other than VOL) you'll be put on ATM/Alcatel equipment anyway. And un-plugging the phone line and putting it back in is the only way, unless you power down the modem which will knock you right out of telnet

[text was edited by author 2001-11-03 19:41:03]

Thanks for your reply, phearz. There is only one ISP in my area that offers 7 Mbits/sec down, but I'm not ready to shell-out $140/month. Maybe someday!

Do you have any advice re: interleaving?

Ron

Add $102.95 to that $140 for Verizon's line fee And I have no idea about the interleaving... sorry bud

Edit: Ahh! Typos!!!

[text was edited by author 2001-11-03 12:23:18]

On the bottom it says "FC9660RA14" nothing about Issue 2.

I don't have a firewall, but I do have a router. Maybe that's why I can't telnet in?

Bingo! Try hooking up directly to your comp.

said by Kukuman:

---

On the bottom it says "FC9660RA14" nothing about Issue 2.

I don't have a firewall, but I do have a router. Maybe that's why I can't telnet in?

---

Yuppers, you'll have to connect one computer directly to your modem and set the IP address of your computer as specified above. 10.x.x.x IP addresses are "non-routable" and your router will not send along any data with a destination of 10.x.x.x

Cheers!
...darci...

Anybody looked around and found a command to actually pull up your line stats without re-syncing the modem? That's the only reason why I'm screwing around with this

I had heard reports of people messing with their own modems, but since the Fujitsu modems were always supposed to be a dumb bridge, I figured it was impossible.

Phearz how in the world did you stumble across this? This almost seems too good to be true!

Now I wonder how many things you can change from your end, PHEARZ WHAT YOU HAVE FOUND IS MORE THAN A STATS MENU, YOU'VE ACTUALLY ENTERED MENUS NEVER INTENDED FOR THE CUSTOMER TO SEE --> Quite possibly you could change your line speed or do other things considered *illegal*

Way to go man! Next step: hack the DSLAM (and no I didn't think that was possible either)

lol, you cant change line speeds or anything... not possible, thats all done from VADI's end but this is how i found it... i downloaded the firmware update for the ra14 modems and my firewall caught it trying to connect to 10.10.207.100, then i realized my adapter had a new ip.. so i went "hmmm...." and added that ip to my adapter after the firmware update was done, opened telnet and typed in the modems ip, and bam! i was in, got the password on the first guess

edited for evil typos.

[text was edited by author 2001-11-08 19:49:01]

Where did you find out there was a new firmware for the Fujitsu Speedport modems? Is there a Verizon page for it? How can I get the new firmware?

»upgrades.fnc.fujitsu.com

All it does is update an RA14 to RA14 Iss. 2 which solves some sync/line issues. If you're good now, dont bother upgrading.

username/password is dslupdate/ca11

I get an error trying the login and password.

Hey this is great, now we don't have to call VADI to check for slow speeds, we can check our selves to make sure we are provisioned correctly...Fantastic! LOL

Then I want to know how to telnet into the white Westell cause I don't care what VADI says, I'm gonna get that 7100/768 and maybe even higher -:)!! Light speed even!

Here's what I did. Cross over cable from modem to hub. Linksys BEFW11S4 WAN to hub and BEFW11S4 LAN to hub. Disable DHCP on Linksys and assign working ip subnet and dns to the Mac. Verified IP connection to outside world. Assigned 10.10.207.101 address to Mac. telnet 10.10.207 , enter password.
ip
config
subnet add bridge.home . 192.168.1.0 ff:ff:ff:00
config
device add bridge ether //bridge mtu 1500 192.168.1.150
config save
restart
Set Mac back to working 192.168.1.x configuration.
Surf the net and telnet into 192.168.1.150 at the same time.

Don't blame me if a typo or omission screws up your modem.

This was cool but I think that my telneting days would have been over if I had messed up the firmware. Is there anyway to force a reset of the firmware if you screw it up?

Also my linksys just froze (red light lit-up) for the first time in months. Maybe it doesn't like seeing the private network on the public side or vice versa. And now it did something else weird. Don't try this at home!
[text was edited by author 2001-12-18 03:18:10]

Not to sound silly, but you're saying the VADI (Dunno what that is) determines the speed package for our modems? Stupid question, but how does this system work, or are there any sites with information on the Speedport Dslams?

Bump

This was timely. I've been trying to determine if Verizon provisioned me wrongly with 768/128 instead of 1.5/128. Below is what I got when doing the above:

Startup mode : ADSL1 startup
tone_range_up ( 7 , 30 )
tone_range_down ( 31 , 255 )
tx_atten (AFE,scalar) 0 1
agc down 22 up 0
ref_atten -61.20000076293945
noise_margin down 48.93000030517578 up 30
net fast rate_kbps down 0 up 0
net interleave rate_kbps down 768 up 128
bruto fast rate_kbps down 96 up 96
bruto interleave rate_kbps down 960 up 224
max_rate_kbps bruto ( not include redundancy ) down 12796 up 1112
max_rate_kbps net down 12668 up 1016
interleave dep 'D' down 4 up 4
interleave frames per cw 'S' down 4 up 4 ( 0 means s=1/2 )
fast redundancy per frame down 2 up 2
interleave redundancy per frame down 3 up 1
bit swap enable status 1
SEF tones (44 64) threshold 4
End of startup (modem 0)

Is this an indication that they did provision it wrong?

Mike

If as you say, "you cant change line speeds or anything... not possible, that's all done from VADI's end", is there any benefit to be derived by being able to telnet into the Fujitsu Speedport???

Yep, you are provisioned at 768/128. I'd give Verizon a call.

As in my case, to know whether you were provisioned correctly.

Seems to me that you could determine if you were provisioned per your selected plan simply by the speeds you are getting - rather than hacking into the modem!

the speeds you are seeing are the SYNC speeds, these would be the maximum cells that could pass between the ATU-R and the ATU-C. VADI stands for Verizon Advanced Data Inc. VADI now has a new name..but I don't remember what it is at the moment.

If anyone has this firmware upgrade, I'd be most in your debt if you could send it to me. The password on the upgrades.fnc.fujitsu.com page has long since changed, it seems.

Thanks