we're good now dragging the car
you know those secrets that they say the
secret machine can read everything all
right we ready
so Brian's going to give a talk about
docsis now so so please welcome Brian
and and here you go how's it going guys
all right so my name is Brian Wilson I
handled his slim jim 100 actually worked
for this company but here on my own
recognizance so the group I'm with is
middle Georgia computer users group
we're actually in the process of opening
a hacker space here shortly and making
is a not getting high I can hear me okay
so I'm part of computer middle Georgia
computer users group we're out of a
middle Georgia probably best thing to
say it's making area about 80 miles
south of here here shortly we're going
to be working right now on opening up a
hacker space so the web address for that
is techno dorg thank you and like i said
uh we got that land party we're going to
be hosting april second and third in
macon so you know the website and go
there and check it out the information
on that so today I want to just go over
some of the basics of what docsis
protocol is and how it interacts with
the seams yes so how many of you here
have a cable modem at home just about
everybody all right so a few of you
probably have dsl and maybe some of you
have fiber to the home hopefully
nobody's in dial-up so doctors the
protocol your cable modem uses to
communicate over the radio frequency
let's get back to the cable companies
head in for them to provide the ISP
services for you it's very need a
high-level look at it so we're looking
at now is we're looking at the cable
broadband architecture and we're going
to look at in a few different ways and
there's gonna be some you know simpler
ways then we get little more advanced
looking at it but as you can see on the
slides there you've got the Internet
cloud over here then you have the
service provider IP core network within
that network that connects them into the
sea mts came
transmission system which is a big
router and then from there it actually
goes out over the optical plant
eventually to call actual RF plant and
if we're really lucky we'll get it to a
drop and then we'll take it into your
house from there it'll plug into your
modem set-top box emta whatever services
you subscribe to we're focusing on the
cable modem here today and we're going
to go over to how docsis works and how
to interaction the CMT s and kind of go
to the very basics has anybody heard of
docsis before now okay if anybody has a
question any point in time just know he
asked if I was going to talk about cable
modem and capping uncapping hacking or
anything else like that no I won't talk
about that because that's pretty much
that to service so it's illegal probably
not i can tell you i could probably tell
you that anything you do in a docsis
network because it's an RF signature can
be tracked so as anonymous as you think
you might be with the RF spectrum and
information timing offset of the actual
decibel level of your device I could
probably track you down within 50 feet
on the cable plant of where you're at so
even if you were to clone somebody
else's information and show up somewhere
else in town and master it is them doing
bad things we can still find out exactly
where you're at and it's instantaneous
we just have to do some basic formulas
to figure out timing offset from fiber
optic to co actual and then where the
tap losses and I can usually get with it
about 50 feet of where you're at and if
that's in a building yeah yes I do yes
ok so for Cisco Systems I'm a network
consulting engineer title pretty much
says it all I support major cable ISPs
my side is a consultant is I could
actually I don't even necessarily have
to recommend cisco gear when the when
the customer engages my team we are
advocates of the customer so we are
their consultant though we you know we
do work for a vendor our job is to make
sure their life is easier and they have
the right solutions in their network not
necessarily buying this or that but is
this what you need and how is it BES
implemented to your network to help you
make money so what is docsis docsis is
table of data over cable service
interface specification it was created
by cable labs cablelabs is a nonprofit
research and design custodian dedicated
to pursuing new cable technologies
CableLabs was created by the cable
companies they didn't want proprietary
expensive gear that they couldn't get
out of so they pulled together the big
guys and they basically formed CableLabs
a nonprofit organization then the
vendors have to if they want to be
docsis compliant they have to go in and
work with cable apps to get their
equipment certified once their equipment
in your technology certified any member
or vendor the alice is also in that the
cable abs group has access to that
information patent free so that keeps
costs down and actually allows you to
have a forty dollar modem which when you
look at the chipset the information all
the actual hardware that's in there if
it was proprietary it probably would
have cost about seven hundred bucks so
with having CableLabs it keeps costs
down and it keeps things open and it is
an open standard with what they write a
lot of stuff that probably wants you to
become a member or sign into to get some
of the information but if you're really
interested in docsis and you want to
know all the information about it
bit-level the information is available
out there so docsis defines the
interface requirements for cable modems
involved in high-speed data distribution
over cable television system networks
basically it makes your cable modem work
so second ago we looked at a cable TV
plant well now we're going to take them
to the look at it and this time we're
looking at in a little bigger view
so they're okay my mouth shows up
alright so here you would see like the
intended would represent off air video
transmissions local TV channels
sometimes your your cable company may
not have a direct fiber feed to get the
video stream in so they may actually put
up a set of bunny ears on a little tower
out there and actually pull the signal
in that way to inject it into the
channel lineup they're also going to be
pulling out services off of large-scale
satellites and those are going to be
services your HBO ESPN CN you know all
this all the services they offer you
they're not locally made there from all
over the place there other you know
other broadcasters and they're going to
collect those off the satellite once
they get those they're going to bring
them in through fiber and eventually go
into what's called a head in the local
headed is where all the equipment is
that's where the channel lineups at
that's really why you're combining
that's where your transmitters your
optical transmitters are because for the
cable company to provide services see
you in the modern day environment they
actually send all the information down
fiber all the way up into your
neighborhood into what's called a node
the node if transfers the optical signal
back into an RF technology and that's
usually between 5 and 11 megahertz and
our gigahertz so within this diagram
here we use to the local head in you see
the symbol for a router you've got
receivers modulator scramblers hfc
interface which is hybrid Co actual
fiber you've got the local head in and
then from there you go to downstream and
upstream in this case they're doing
actual these are going to be separate
optical fiber paths once you get from
the optical fiber paps you eventually
get to the dark blue line here and that
would be the hardline coax thats hanging
on the telephone pole not the skinny
stuff in your house with a much more
robust aluminum fed eventually that gets
broken down through amps and line
extenders it gets stuck to the side of
your house at the audit box and then
from there it goes in the rg59 cable you
know that you have your walls down yet
again another demonstration of the same
basic diagram and a different format and
what we're trying to pretty much
represent here is you see the head and
you also have what's called
sites so that's going to be another site
similar to the head in that maybe closer
geographically to where the customers
are going to be serviced and then the
signals may actually leave their
optically before they going before going
to coax and then these little things
here no these are actually fibers strand
about the size of a shoebox their pole
mounted or their pedestals on the ground
and you know that's that's we get that
and then awesome the outside cable plant
you're going to have power supplies
every so often so it's going to be a big
box of hanging up on the telephone pole
or in a pedestal aground when they myth
inside those there's car batteries and
that's they get local power from the
power company but they have a battery
backup in the event local powers lost so
even when the power goes out nine times
out of ten your cable TV is not down you
just can't turn your TV on so if you
have MTA voice services to your cable
provider so if you have a voice enabled
cable modem a lot of those will have a
battery backup in it reason being is
just because the power went out it
doesn't mean the cable TV networks down
you can still make phone calls most
models of the emta devices will shut off
the ethernet port so you kind of backup
you get to your laptop running and the
reason they do that is the battery can
only sustain the devices for so long and
keeping the ethernet port and the rj11
ports all at the same time with drain
batteries and necessarily the idea
behind the battery backup is to keep the
phone service up nigga you have an
emergency or that your alarm system
still needs to call out good
it could be or could be the simple fact
that there could be signal loss or an
active component failure so when you
have the power loss it actually could be
you know catastrophic so yeah an
amplifier goes down you x edit n you're
going to lose it cuz you're going to
take a large DB attenuation there the
only other thing to point out here real
quick would be there's a slow error here
this is downstream this is the frequency
base you're actually going to receive
from the cable company directly to your
house 88 to 880 megahertz or actually
you could even go up to 1 gigahertz so
that is also referred to from the RF
guys as the forward path that is the RF
frequency coming coming from the cable
provider to you well that'd be kind of
useless to have one way communications I
mean if all you could ever do is listen
and you can never respond well then you
really don't have communications it's
more like a radio talk show so to
provide services like pay-per-view video
on demand data voice stuff like that you
got to have a path coming back the early
days actually did telco return where you
actually still had to help to a
telephone line and basically what it was
is you received your download over the
cable modem and then your upstream
traffic back was actually over an analog
modem which is called telco return weird
actually dialed a modem you know modem
back to get the upstream back typically
people people like why isn't symmetrical
eyes the service not symmetrical well
I've just point out the downstream
there's another little area here you see
where says upstream that's only five to
forty two megahertz you see there's a
big difference in the frequency base
between the downstream and upstream with
that being is the upstream is extremely
limited now there's not a lot of devices
that need to talk back so you have your
cable modems you may have proprietary
phone systems devices you may have the
set-top boxes that need to have
transmitted back pay per view
information or channel lineup in
information it's really cool that you
can call your cable company and change
your service and the Box magically gives
you those channels I mean nobody likes
to wait for somebody to come to your
house to fix the service or add
something so with the two-way
communications it's not just convenient
for the cable or the cable company
themselves but it's also community for
the customers I'm pretty sure most you
can read so I'm not going to bore you
with reading but your cable your cable
is going to come over your cable TV
services coming over 75 ohm coaxial
cable usually RJ 59 sometimes rg11 six
again kind of how I explained it back in
the old days and when cable TV was
considered community antenna it was one
unit you know unidirectional one way to
data path they provided you pictures
they sent the information to you you
never talk back more recent networks now
is the hfc design where it's actually
five are up too close to the
neighborhood and at that point you have
two optical paths one forward and one
return where you can actually transmit
data back and your Ford is considered
your downstream and your return is
considered your upstream so you're
combining so what you have here is in
North America we use what's called mxb
okay there's actually two annexes
there's an annex a and annex B for your
frequency allocation so with amex be in
North America it's actually six
megahertz block is considered a channel
in Europe and and it's a countries it's
eight megahertz so it's a slightly
larger and it's the same thing with with
with euro and everything else with the
t1 vs e when they always wanted a little
bit better so good for them but most of
equipment out there is going to be
suited for docsis there is two flavors
docsis docsis and euro docsis and there
is one little additional docs tether
called j docsis for japan the only
difference between doctors and j docsis
is they actually give you the ability to
have a slightly larger upstream
frequency base so in North America we
have five to forty two megahertz and
Japan it's five to six five to sixty
five and then Europe at salsa five to
sixty five but the J docsis doesn't use
annex annex a they use annex b six
megahertz on their downstream channels
so if you have if you have that
frequency base that you know 88 to 880
if you're actually inserting media or
MPEG frames in there and you were doing
it in six megahertz blocks you got to
make sure you only put one service there
video whatever it is right either one TV
channel an HD channel one docsis carrier
depending on what your injected but you
can't inject two carriers in the same
exact frequency on you know at the same
at the same channel with because you're
just going to get garbage they're going
to basically right on top of each other
and it's going to be noise so you do
have to make sure you properly place and
map out your channel lineup and then on
top of that wherever you have you know
get six megahertz space in there you can
allocate that to a docsis carrier the
cisco 7246 are 7200 series you be our
universal broadband router or uber is
the one of the product family lines that
cisco uses motorola uses a device called
a BSR eres uses one called a c4 or c 3
and then a dc-dc big man used to have a
device called a CUDA but they went under
and stop making it and then Terry on had
12 called a blue wave and they went
under and motor all about them so in the
CMT s market for vendors that actually
can sell the equipment to make the cable
modems work you really only have like
three vendors to go with motorola cisco
and errors cisco has the largest largest
market share there's pros and cons of
each you know each vintage hardware
upstairs in our room at in 226 I
actually have a 7246 vxr router up there
with a six foot cable plant bailed out
with Kevin modems actively online after
this talk and later this evening
probably after six ish if you want to
come up to 226 just knock on the door
and if you actually want to come in and
jump on the CLI you know we've got three
hundred thousand dollars in equipment
sitting up there you play with good
we're probably going to have the
security thing with the door just pried
open but you can find myself Brian you
can find DJ you can't miss Jason he's a
little guy you've got bliss and Troy
back there sitting side by side so any
of these guys here are part of the
middle tour the computer users group
what's that well the door is locked and
you know this this device is not light
you can ask DJ because his backs better
than mine I just don't see anybody
really trying to get out the building
with that plus it's all serial number de
trackable so no we're getting ready to
go into that and if you want to see it
real time like I said we've actually set
up a six foot plant up in the room I was
going to try to bring it down here than
I talked to Scott and Scott said I'm
gonna have lots of stuff on the table
it's going to take me probably 20
minutes to get it all up and I was like
well yeah and I really don't to carry
that router down so we got the router
actually set up set up live ready to go
up in the room I think we have like
seven or eight modems on it we could
even add more I only had I only profit
16 way splitter so I only can actually a
lot so much so many devices plug to it
so this device here if it's the 7246 vxr
and i'm not trying to say anything I
don't really care I don't think any of
you could afford it or have a need to
buy this equipment so I'm just putting
the technology this device here is not
end of life it has been around for like
12 years but just recently they've come
out with a newer line card for this one
and a newer processor so it will be able
to do docsis three auto so some of you
probably heard the terminology docsis 30
you're like wow that's going to be great
well each version of docs this has to be
backwards compatible through CableLabs
so docsis 10 there is no quality of
service best ever date of law docsis 11
actually added costs and the ability it
is to kill out different kinds of
service flows into dynamic service flows
docsis 20 the only thing that did was
actually increase the modulation in
types of statistical multiplexing you
can do in the
On the return plant or the upstream to
allow higher data throughput on the
upstream it didn't change how fast you
could download that was the same as
docsis 11 and then docsis 30 we've in
essence basically giving you the ability
to bond multiple downstream frequency
channels so where you had one downstream
in the past we've actually about allowed
you to think of it as ready to stripe
that across so we're you had one
downstream now you could technically
like eight and we had one upstream you
could actually bond for and we're just
basically using package with packet
sequence numbers to recombine it back to
you there is some other things like IP
version 6 and docsis 30 advanced multi
casting 256 aes encryption built into
the device to protect your data stuff
like that but the biggest motivator for
docsis 30 is one defender fios
fiber-to-the-home to provide faster
speeds with I mean there's always
politics behind everything and with you
know the new administration saying
they're going to put money and getting
broadband everybody which has been said
before it does give the msos or cable
companies a little motivation to go out
there and start upgrading some this
equipment it is not cheap or easy to do
this it's not like flipping a switch or
buying a new box because you're older
devices they have to be backwards
compatible if you still have docsis 10
devices on your plant you can't turn on
all the features for docsis 30 without
making those things brick and the
average cost to rolla truck to
somebody's house is 100 bucks because
you got insurance the employee all kinds
of stuff the vehicle so if it cuz if
you've got 30,000 devices on your
network of small network actually that's
a very small Network and 10,000 or
docsis 10 devices out there still you're
going to have to find a way to get those
off the plant and if they are leased to
the customer okay it's your
responsibility you can probably roll a
truck but if the customer owns they may
not want to upgrade so unless you're
giving them a modem free so now you're
not only you're paying a hundred ah
leurs roll the truck you're actually
spending another hundred dollars in
hardware and they're paying thirty five
dollars a month so there are some
roadblocks that are all technical some
are some are technical some are
financial and it isn't necessarily about
the equipment it's just about the fact
that this stuff is backwards
paddle for a good reason but it can
limit so if it's a green field
deployment and it's a brand new place
and you're just lighting it up you're
good to go of course if that's also the
situation you may go with wimax or
something wireless or you may just run
fiber to everybody's house so there's
pros and cons their thing and there's
multiple technologies and some customers
i support actually own the telephone
company they actually have fiber all the
way up to like the edge of the
neighborhood and they have a cable plant
and they're trying to figure out how
they get most bang for the buck and a
lot nine times out of ten they're going
with docsis the simple fact is is
there's a lot of research there and it's
a very strong protocol well doctors has
a protocol so I don't really know what a
competitor would be no there used to be
there used to be very close standards
and there was there was no necessarily
docsis at the time so the original cable
one was like the old shark fin is and
the original stuff out there that was
proprietary so not only did you have to
buy this vendors hardware yet by this
manners modem which makes it very
expensive so this is going to go through
and again I'm not going to read it
verbatim for you but this is
representing what's called a 1 by 6 line
card one downstream sticks up streams so
remember the downstream is from the
cable company out to the customer the
upstream would be the return path so on
the downstream I only have one port
remember I have a 88 to 880 or 1
gigahertz range on that downstream at
six megahertz wide and I'm suiting that
down that's actually going just like one
little neighborhood area and that's
that's the downstream that's your
download now if you need to talk back to
the cmds you're gonna have to come up
over an upstream port so on the upstream
side you can actually it makes sense to
have multiple upstream supporting a
single downstream and since this is an
older lying card this is I think this
extra line car we're looking at right
now is into life's this slide decks kind
of old but they cover some of the real
good basic stuff I didn't want to come
in here like doctors 30 and talk about
like MDD messaging and you're like huh I
want to try to keep it basic and keep
you guys in the same note we can go a
lot deeper later but basically in most
cases you're going to have one
downstream and possibly multiple up
streams now the device is using the up
streams it'll be multiple devices but
one
you know one device mean if it's docsis
if it's less than oxes 30 cannot use
multiple extremes by itself so one modem
may not won't be talking on to upstream
frequencies though there may be two
upstream frequencies available to it
it'll pick one and then as utilization
and network connectivity pick up it can
load balance between them and move the
guy over to this one or over to that one
and you can actually have multiple down
streets to and do load balancing across
down streams in the same fashion one
thing to point out the little device
down below this you see from the
downstream they got this here then they
got an attenuator and then they got this
little device called up converter so
originally the downstream just like in
the TV network when you got a channel
prophet satellite receiver the output
was what's called if' intermediate
frequency that is at 44 megahertz
thinner frequency the end not modifiable
that's what if' is so if everything came
out at I F at 44 megahertz well I can't
really do everything there that's where
you get the up converter where it takes
the I FN and then turns around and in
the upconvert of your program what
downstream frequency or channel you want
to provide that service on and that
helps you build your channel lineup all
of the newer cards that are for the
different types of cmcs is out there
with all different vendors now have
built-in up converter so you don't have
to have a separate piece of equipment
the device I have upstairs in our room
has three 1 by 6 cards in a 2 by 8 card
the to buy a card has a built-in up
converter so we have one less piece of
equipment so that's the one we hook in
the motives to right now but just a
little side note so 44 megahertz is what
is called a intermediate frequency in
the cable world so our upstream again I
was explaining earlier our upstream
ranges from five to forty two megahertz
typically that's pretty low that's
pretty far below the lowest downstream
TV frequency which would be sitting
about eighty eight megahertz and kind of
a sidebar real quick as I was talking
earlier about channel lineups so 16
megahertz slot in the downstream for a
TV channel well that's what you need for
one analog TV channel but if you're
doing digital I
actually fit 10 digital channels in that
six megahertz block if you don't HD I
could probably put three HD channels in
that six megahertz space but if you're
doing analog is extremely wasteful and
it takes that whole six megahertz
carrier that's another reason the FCC is
pushing to get rid of analog TV because
from 88 to 500 megahertz is the analog
range and that's basically wasted
bandwidth so where I could have put only
one one one carrier 11 television
carrier for six megahertz if I can get
rid of the requirement to carry the
analog i can now stack 10 digital
channels and possibly 15 of giving
depending on compression in each one of
those slots and then i can stack
anywhere from two to four HD channels
per six megahertz block so again analogs
extremely wasteful cable modems these
are some older pictures to modem devices
but basically I think we all understand
kind of what a capable de ms they
usually have two data interfaces at
least classically they did they had a
USB port and even a jack for the
customer and then an f connector or
coaxial input for the cable companies
feed any of your newer capable devices
you're probably not going to see the USB
port on anymore one I think it was
limited about 11 megabit per second
actual throughput and to nobody used it
is this an expensive additional port you
have to put in a piece equipment that
almost nobody uses so most of the newer
cable modems out there from all the
vendors have taken off the USB port so
there's an error so cisco linksys which
is also cisco and a motorola in the
picture below so keep them on an
upstream and downstream I kind of beaten
this already so I'm just going to touch
it real quick the downstream 88 to 880
or possibly one gigahertz very large
pipe lots of places you could put
doctors carriers the upstream five to
forty two megahertz not a lot of places
to do data not a lot of frequency base
there are a spectrum where we could use
that's another reason why you don't have
symmetrical services that's why you
could get a lot of times Jephson like 10
down and like one up
sure doc says 30 has increased the
upstream to 65 megahertz the only
problem is the cable TV plant has stuff
called roll-off filters and die flex
filters and those actually cut the
signal off at about 42 megahertz so for
them to provide a bigger upstream they
got to go out and replace every active
and passive device on the telephone
poles not really remember internet and
data is something that's actually pretty
modern cable TV has been around before
the internet nobody was using that
frequency base it's actually a really
bad place try to suit you to actually
probably do data communications it's
very noisy does anybody know the
frequency of citizen band radio 27
megahertz that's right in the middle of
that carrier so if anywhere in your
cable plant there's a loose fitting a
squirrel cheat on the hardline feeder
somebody got a cheap radioshack twist on
connector something like that you
actually can take what's called ingress
an injection or have suck out of the RF
at 27 megahertz so I can't put a docsis
carrier there now because there's too
much noise there won't transmit right
theres also 6 meter 5 meter ham that can
interfere remote stroll Tilo kids remote
control RC cars that's a 2742 megahertz
so there's a lot of characteristics that
people don't really think about but your
RF plant in the field is like a living
creature it's constantly changing it's
constantly affected your decibel levels
in the morning and the evening are going
to fluctuate because what happens when
metal when it gets hot it expands the
distance between the two devices have
now actually changed so there's a lot
more to it than just the extreme basics
and if you really want to get deeper in
RF like I said take up with me but you
can spend your whole career just try to
understand the characteristics of signal
so it's best just to get a good grasp we
have a good understanding of the basics
of how it works and then try to continue
to build on and not try to dwell too
long in one area
because none of this none of us can be
like know-it-alls and everything we can
be good at something we be okayed a lot
of things but you know there's no way
and there's a lot of stuff I don't know
if I don't know what I'm gonna tell you
don't know but I'll probably have to
look it up for you so we're looking at
the downstream there's something else up
to us so I told you the channel with six
megahertz there's one thing I didn't
tell you yet and is the modulation
scheme so how are we modulating the
signal well currently you have about two
choices for modulation 64 qualms or 256
qualms so the raw throughput of a 64
quam carrier the six megahertz wide is
about 27 megabits per second for data
traffic a 256 quam carrier will give you
about 38 megabits per second the other
two fields over here where it's talking
about required a minimum CNR that's
actually carried a noise ratio it's not
the same thing as signal-to-noise ratio
there are actually two different
measurements that people mix them up on
the upstream side and again we I'm not
going to sit there and read verbatim
every part of this life is well run out
of time this is normally like I cut a
150 slides out of this so there's only
70 here so it's not too bad and we
probably won't cover all that but
normally the basics class would take a
week to go into with labs to kind of
cover some of this but on the upstream
side we actually have different channel
waves we can use so on the downstream
we're locked in its debt at six
megahertz and x ir b because those are
TV that's that's what the TV industry
did way back when and the FCC gave them
that's how they were a lot and how to
give out spectrum well on the upstream
side that's more recent that's for like
pay-per-view for the internet stuff so
it was a little more flexible with that
well you actually have different channel
whips you can select when you're
configuring the router you can do 200
kilohertz 400 kilo hertz 800 1.6
megahertz 3.2 mega hertz or if your
plant is pure docsis to or better you
can actually even do a 6.4 wide
megahertz carrier on the upstream and
then down below there again is also
different kinds of modulation you have
that you have qpsk which is robust and
can handle noise but doesn't provide
a lot of throughput you have 16 qualms
which docsis 10 11 20 and 30 are all
able to use and 16 qualm is not as is a
little more susceptible to noise but
gives you more throughput so if your
maintenance guys out there those bucket
trucks aren't tightening it up and
fixing that plant daily you're going to
have a harder time running 16 quam
without taking a higher bit error rate
or modular modulation error rate
depending on where that you know where
the failure is you may only be able to
do qpsk because it's much more robust
and basically just think of it as error
checking if I take one error i can
assume what it was and fix it but if i
take three errors in a row at that point
i probably can't fix that because I
don't know what I don't know how to
correct that one or zero that's the same
basic theory here what noise comes in it
overrides of legitimate data and causes
his scrambled garble crap and you're in
able to really correct it do error
correction on it the throughput ratings
here so with qpsk you got 200 400 800 in
a 1.6 2 3 12 wide channel whiffs you're
not going to see anything out there
today that is smaller than 1.6 the
average is a 3.2 wide carrier if the
company that's servicing you thought
ahead and got rid of the 10 modems in 11
modems and all the motors in their plan
or 20 then they actually can do a higher
upstream modulation and a bigger channel
with they could do the 6.4 wide and they
actually can do a 64 qualms upstream
which a 16 qualms would give these gives
you about 10.24 megabit per second up a
64 qualm is somewhere around 24 megabit
per second and then there's also other
ways to do that too again you have your
required CNR your minimum seeing our
values any questions at this point
quam is a modulation type it's it's much
beyond this talk but yeah I mean we'd
have to get we'd have to go into some
deep math to to explain it it's easier
to just explain this and try to go
through the slides but basically through
the picture you can see that the red
line would be a downstream and then you
see the other color lines the blue
orange and green those are up streams
remember I told you you can have one
downstream but you might have multiple
up streams in this case each one of
these streets are service areas are
sharing a downstream which as we just
seen has a lot more throughput than an
upstream but each service area may have
may have a direct route back to that
seems yes on its own upstream so how's
that work well each of these up streams
can actually be set at the same
frequency because they're not going to
the same people just because they share
similar downstream doesn't mean that's
in a different frequency there's a
diplexer filter there so you take the
high frequency here in the low frequency
there and you combine them together and
you feed the customer there's no back
feet across the downstream or the
upstream from the other carrier or
connection so that allows you to
actually run the same frequency on your
up streams and run the up streams to
multiple service groups you cannot put
the same upstream you can't use upstream
zero and upstream one to the same node
in the field at the same frequency
because again you're writing a top each
other they may be at different
frequencies so how does the cable modem
come online anybody have any idea right
now besides people that know me
you plug it in and how does it know how
to transfer data and actually
communicating the cmps is it automagic
so at this point if you're if you're not
bored to tears just yet I'm going to
actually explain the cable modem ranging
process and how it comes online because
it is a semitic it is a systematic
process and when troubleshooting errors
I can pretty much figure out where the
problem is by looking at how it ranged
or if it was able to complete ranging
because it will tell me I mean mother
most of us here understand
troubleshooting right we don't start at
layer 7 we normally start a layer 1
right but is it is it plugged in and
then okay is the playdough is it turned
on and that's the basic truck that's the
basic theory here is when the cable
modem first gets there right and you
plug it in and you turn it on well
what's it going to do well it's going to
scan for a downstream frequency it's got
to listen before it can talk well
everything's actually encoded in peg on
the rfm but there's a special frame
header on the impact frames for docsis
well you can actually a multiple you
could have one cable company but you can
actually have them reselling their cable
service plant with another scene PS from
a competitor or another company on the
same cable plant so you got to make sure
the motor was go to the right place well
part of the ranging the initial ranging
process the first thing is going to do
is disk it asserts its going to charge
scanning frequencies on the downstream
and in this example this is actually a
debug session from a cisco modem we can
see it's at 537 didn't see nothing so
then it goes next the next frequency
what why is the next frequency 66
megahertz up because this is a channel
with North America keeps going
eventually it'll actually see it in here
it says cable modem logged es downstream
64 quam lock acquired it found a
downstream 64 qualms ignites like sweet
i found my downstream now i gotta wait
and the wait state at the very last line
there where it says wait UCD state you
see d stands for upstream channel
descriptor it knows it can hear now but
it
not know how to communicate back to the
cmps it doesn't know what frequency what
modulation scheme what channel width it
doesn't understand that yet that's why
it's waiting for the upstream channel
descriptor because the cmcs and the
downstream is always telling everybody
just case someone wants to come online
it's always screaming out the upstream
requirements for that downstream so if
you're on this downstream bother you
know if you just came on this downstream
by the way I have these associated up
streams at these set parameters if you
want to talk to me so it goes through
the UCD so now it's scanning through and
it actually finds an upstream upstream
channel descriptor in this case the
upstream channel descriptor is telling
it 33 megahertz is the center frequency
of where you need to be to talk to me on
top of that it's also going to negotiate
other information like modulation
channel with stuff like that okay so
reading process there is there is
something that you also have to
understand too is the cable plant so
when it comes to you comes your
neighbors on fiber when it hits that
node it's either up in the pole in the
pedestal the people that are closer to
that node this isn't dsl they don't get
to go faster but their signal
characteristics will be different then
the guy further down remember before I
told you plug something in my plant that
isn't legitimate and you start trying to
screw around I can find you well this is
why you can't come online without
properly knowing their right timing when
to say how to say it and you have to
have an offset so I have to understand
the furthest modem away I have to be
explained I have to have built-in delay
on all transmissions just in case he's
talking to on the same fact I can also
figure out the distance on the planet
through the timing offset but there'll
be different characteristics to the guy
that's closer won't have to transmit his
loud the guy further away down the plant
the farc a mode he's actually going to
have to speak a lot louder for me to
hear him as the CMT s so his transmit
value in decibels is going to be a lot
higher than the guy that's closer up
there are other ways to combat that the
actual taps they plug your drops in to
have decibel values and they can change
the plates dad more attenuation or less
attenuation
depending on how far away you are from
the hfc node typically so hfc know
typically would provide services
depending on the cable company and their
migration plans to kids okay the fact
the more the fashion that speeds they
sell you the less customers per node you
want right I yet to actually be a cable
company that over subscribes on purpose
and once to like get ninety percent
bandwidth utilization per node most the
time I've seen anywhere from a customer
recently worked with only had 32
customers for fiber note the average is
about 250 to 500 depending ninety
percent of your users are using no
bandwidth almost never they're checking
their email looking at Facebook they're
not downloading stuff right and that's
the customers you like they pay you the
50 70 bucks a month and they don't even
really use a service then you have the
people like us we want the cheapest cost
and we're going to we're going to
bittorrent that thing until it bleeds
and we're going to take as much
bandwidth as we can get out of it we are
the bad customers so the theory goes you
know five percent of your babe you know
one hundred percent of you like ninety
percent your bandwidth is actually being
utilized by like the top two percent of
your customers like only two but here's
only two it's only like two percent your
customers are using most your van with
everybody else is really doing nothing
they're doing their windows updates and
like searching on Google so kind of acts
the rage process so this is debugging
actually on a cable modem and this is
basically this is a physical console
into a cable modem I'm actually looking
at its process and the messages it does
i'm watching at each stage as it tries
to come online and actually get an IP
address and hit the internet so the
first stage was it scans the downstream
it finds a frequency that is actually
docsis once it finds that downstream it
waits for a depth stream channel
descriptor a second ago we found that 33
megahertz well now in the raging process
we actually have to work on getting our
power levels correct so the first thing
I do as I say the same TS can you
me and I wait for response on the
downstream that'll get a response my
assumption is I didn't speak loud enough
you can you hear me a little bit louder
and I keep screaming until finally I get
a response so in this debug here you see
that it starts at six TV then it goes to
nine then 12 then 15 then 18 and then
write their range response message
received it got word back that the CHS
could hear it at that point the same TS
might say do why you screaming turn your
level down 6 DB or I can barely hear you
can you talk a little louder but that's
arranging process that's ranging state
which is called in it or one and that's
just they finally actually had
communications guess what physical layer
works ice cream can you hear me the same
she's came exit I can hear you by the
way don't yell at me for so the next
part of it is actually more or less the
fine-tuning part where he says hey yeah
I hear you you're too loud you're too
quiet duo power adjustment for me after
that's done the last stages ranging
complete we're good to go now I can talk
to the cts but I don't know what my you
know that I don't have an IP address I
mean I'm a lair to device right now all
I have is a mac address I don't know
what my service levels are what's my
upload and download speeds suppose to be
set to do I have devices hooked into my
ethernet port and do they need IP
addresses so all I've done at this point
was give the five level activity done
and now i'm at layer 2 next stage
familiar to is going to be layer 3 we
need an IP address we need more
information so we go into the what's
called the provisioning stage so in the
provisioning stage and again i'm just
going to go a passion a lot of these
slides because they're going to say what
I've already said twice probably but and
the provisioning stage the first thing
we're going to do is the modem is now
online but it has not completely
finished registering so if I'm allure to
device and I'm in a quote unquote subnet
or domain right and I need to EGP but
this guy is actually on another network
I talk to him as a liar to device can I
talk to Ken to makana mac address be
routed know so I have to depend on the
CMT has to relay my information if the
dhcp server is somewhere else yes but
it's called cable helper and the CLI so
i sent a dhp discover the CMT s realize
that action out to the dhcp server now
the dhcp server is directly connected
the CMT s still wants to be involved it
wants to know what's going on because at
the other day there are some security
issues here we have to make sure the
correct DSP server is responding so you
know your normal discover offer received
the dora process when it comes with dhcp
so this is going to be a little lame or
since there yeah I hear you offer offer
acknowledgement ok so our modem now has
its IP address which is called an hfc
address it's normally a 10 or 192 it's a
private network between the cable modem
and the CMT s no computers behind it yet
just the modem itself and the CMT s so
there's actually two separate networks
here when you plug your computer in
you're going over basically a media
converter but the media converter has
its own layer 3 connectivity to the CMT
is the cable modem CFG has have their
own IP addressing structure over the hfc
interface or the coaxial cable network
and then on top of that it passes along
IP addresses to the customers devices
your linksys router or whatever d-link
whatever you have or your computers well
in the provisioning process
okay I suppose get through some those
slices right over the load time but once
i get the dhp address and i actually
have an IP address for the cape modem
itself I need something called tu t or
time of day and if I ever dealt with the
time at a server maybe I have any idea
what that is not that timing there is a
frequency timing oh that's a little bit
different the time of day server is kind
of funny but have you ever turned a
device on they didn't have a bios
battery what date did it give you
something 1970 well the motor was going
to do that too because it doesn't have a
bios better anything else so it needs a
time of day server because any time it
has a log or an error or an issue it
saves it to its own little log saw log
server internally and it's going to have
to be able to accurately timestamp that
information so you know if I had a flap
at this point it's not 1970 was in 2010
this date this time this millisecond so
as you're coming up party of a
provisioning process through RFC 868 is
a time at a server once you do your time
at a server then you can move on the
process the next process is going to be
the tftp so this is where the cable
modem is requesting its config file from
the msos THV server this is going to
provide the modem information it could
even be providing it a firmware upgrade
but this is going to be the upstream and
downstream filters the caps
quote-unquote that some people want to
break it's also going to provide
protection for the customer you may not
want your your information and your some
of your network stuff filtered but it's
always probably not a bad idea if
well-known important numbers are blocked
and i'm not talking about port 80
because you want to run a web server i'm
talking about known exploit ports it is
possible to put in the modems config
file port filters are a meany access
control list into it where it knows that
it doesn't need to speak to the Ten
Network it knows that it shouldn't go
here or shouldn't go there they're very
limited and they're very small and you
can only put a couple in there but nine
times out of ten those are there
actually protect the customer there are
some service limiting ones you can put
in there like port 80 and
keep people for something you actually
running an email server because we all
love spam and we want everybody to have
a spam server but there's some of the
things that it can be put in the config
file maximum IP address request is
another one so if your cable coming only
gives you one IP the they can actually
put it in there so if you ever plugged a
computer into a cable modem you got it
online everything else that you need to
switch it over something else and you
plug it in doesn't work you gotta power
cycle the thing well because i had a mac
CP hosts file in there said one and it
already knows the mac address of the guy
that was plugged into it so you've got
to clear it out by resetting it that's
another thing too so once we actually
finish the tftp process the last stage
is actually option files we're not going
to go into that registration request for
official response once it finishes its
registration there is one more stage
which is BPI initialization baseline
privacy interface that's the encryption
so just about every cable company that I
know of that is decent sized at least is
running DPI encryption it's free it's
part of the spec you don't have to run
it but it's probably a good idea so V
PIR BPI plus depending on what version
of docsis baseline privacy interface so
what is that well basically it's a king
mechanism where I can encrypt the data
going down to the customer I can encrypt
that data so only that modem can
unencrypted it and read it so there's no
snooping BPI plus came in docsis 11 and
then actually added an additional field
so BPI the baseline privacy interface
what's Ted up to protect the customers
privacy you don't people sniffing your
banking information you can't you can
sniff on a dog in a data network there's
ways to do that was talk to DEFCON the
one thing that I bring up at DEFCON is
everybody uses BPI so the talk was
useless but there is BPI plus that came
with docsis 11 BPI plus went beyond is
protecting the customer but then
protecting the cable
so with BPI it didn't really verify that
if the device was cloned or not so you
can have two devices with the same
magnetars in the network because they
won't work right so with with depending
on what vendor feature code you have it
will ignore the second one or they both
get on they'll both get knocked off line
depending on features but with BPI you
encrypted the data so nobody's getting
the data stolen but you're not
preventing theft of service BPI plus
they actually had the manufacturers
inject x509certificate into the modems
firmware that's actually built into the
modem that's signed with the frequency
to a root certificate that CA verisign
approved that's installed in actual CMT
s so it can verify that's a valid bender
and there's about device unless you have
the vendors private key to write your
own certificates you're not going to
break it and there's only one way to go
around that that's called a perfect
clone and you actually have the physical
access to somebody else's modem to do a
perfect clone on it you can't remotely
steal it the information off their modem
to replicate it what's that
now they should be available cablelabs
is an open standard but you may have to
be a member to access some of the
reading documents you can feel free to
hit me up later if you want some more
information on it but with dr. Surrey oh
it's actually they've changed the whole
idea on it and it's actually 256 AES
encryption now and the the rekeying can
be said is as low as every five minutes
per device so it's going to be really
hard to break that encryption and most
of us can't afford the equipment and
tools to do it the modem is always going
to be sending communications back the
CMT should always be asking the modem at
least every so often how you doing how
you doing great to know you're there by
the way your your levels are fine your
levels need to be adjusted those are
normal that's normal States and makes
maintenance functionality it's almost
like a heartbeat that's what I just said
right there maintenance so at least one
every 30 seconds it's expecting to see
each modem in the plan what they didn't
touch so the VXR I have upstairs the CMT
s i have upstairs the 7046 txr is
capable of supporting easily 5000 modems
off that one device I have and that's
the small one the one I normally work
with my customers on is the cisco ten
thousand twelve or called 10k 64,000
cable modems / chassis but if you're
providing any real service you're going
to probably have it around 20,000 to
30,000 so the way negress ports and some
of the newer stuff of doctors here
because you're increasing the increase
in the speed per customer you went from
having gig ports on the actual box to
having 10 gig interfaces and multiple to
engage interfaces so I'm just about out
of time this is just a customer getting
the IP address yeah product overview of
me this is a picture of the device I've
upstairs this is the 10k 10000 series it
has has eight line cards over here and
these are five by 20s or 20 by 20 so
five down stream's 20 up streams or 20
up streams 20 down stream's then on top
of that there's the ability to do what's
called MC mts modular see if yes we're
through the when the high-capacity Wayne
card slots I can actually put it was
called a spa or sip a spa adapter and
then I can buy these little koala
modulator and i can add like 24 channels
per one you and just start stacking them
and add 24 more down terms on top of
that so it's gotten more cost effective
to be a cable company with these newer
technologies the cost has come down a
lot to any questions at this time this
is all product literature stuff so it's
not really too deep good
no if if the cable company one to pull
the logs off your modem which it doesn't
contain anything sensitive it's just
signal levels and when it misses a
maintenance they would have to pull that
SNMP so docsis standard says that even
though you have a motive of your house
it's actually responsibility cable
company to maintain that device for you
you're not allowed to upgrade the
firmware on your own and only it can be
done through the docsis interface but
the cable companies also determining the
quality of the network through what it
gets back from each of the modem so
ninety percent of people don't turn the
modems off that they actually use that
to scale to make sure that there's no
outages by seeing those online motives
because they're talking every 30 seconds
anyway what's that
they're pretty generic it depends on the
vendor but there's not a lot you can do
there it's going to trigger anything if
you're really screwing with your modem
they're already going to see for the
most part because your config file
either one you don't have a x509 private
key from the vendor so you're not going
to modify that too if you change your
bin file name they're going to see it
because they're talking every 30 seconds
so I know what's going on so the changes
even beyond signal level I can easily
pull that plus if you tried to clone a
device one you would have to be on a
different CMT s and I would see where
you were and I would see your signal
characteristics like it pretty much
guess where you're at physically in the
real world I could overlay my cable
plant over google maps and then have a
little dot show up like right your house
the only time they get so slightly
difficult when it's an apartment complex
because the houses are so close together
I'm out of time so thank you and room
226 six o'clock related