You are on page 1of 71

***

*** VERBINDUNG: 192.168.200.1:23


*** Datum 09.04.2014
*** Uhrzeit 15:01:49
***
Haxorware integrated telnet daemon
Username: root
Password: ************
Welcome.
CM>
CM> dir
!
?
REM
cd
find_command
help
history
instances
man
pwd
sleep
syntax
usage
---con_high
mutex_debug
ping
read_memory
run_app
shell
version
write_memory
---[HeapManager] [docsis_ctl] [embedded_target] [flash] [non-vol]

dir
ls
system_time
reset
zone

CM> cd n
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> cd d
Active Command Table: DOCSIS CM Downstream Calibration NonVol Commands (ds-cal)
CM -> non-vol -> ds-cal
CM/NonVol/Ds Cal NonVol> dir
!
find_command
man
usage
---clear_device
{flush}
num_coef
show
write
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

clear_tables
frequency
num_freq
stats

coef
ldaix_time
num_ldaix
tftp_read

defaults
manufactured
offset
tftp_write

del_extra_data
master
read
tuner_step

CM/NonVol/Ds Cal NonVol> cd ..


Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> dir
!

REM

cd

dir

find_command
help
history
man
pwd
sleep
usage
---clear_device
defaults
del_extra_data
read
show
stats
write
---[ds-cal] [factory] [us-cal] [userif]

instances
syntax

ls
system_time

flush
tftp_read

manufactured
tftp_write

CM/NonVol> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> dir
!
?
REM
cd
find_command
help
history
instances
man
pwd
sleep
syntax
usage
---con_high
mutex_debug
ping
read_memory
run_app
shell
version
write_memory
---[HeapManager] [docsis_ctl] [embedded_target] [flash] [non-vol]

dir
ls
system_time
reset
zone

CM> cd flash
Active Command Table: Flash Driver Commands (flash)
CM -> flash
CM/Flash> dir
!
find_command
man
usage
---autoTest
erase
show
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

cfi_show
init
write

close
open
writeArray

configRegion
read

deinit
readDirect

cd
instances
syntax

dir
ls
system_time

CM/Flash> show
CM/Flash> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> dir
!
find_command
man

?
help
pwd

REM
history
sleep

usage
---con_high
mutex_debug
ping
read_memory
reset
run_app
shell
version
write_memory
zone
---[HeapManager]
CM>
dir
[docsis_ctl] [embedded_target] [flash] [non-vol]
!
?
REM
cd
find_command
help
history
instances
man
pwd
sleep
syntax
usage
---con_high
mutex_debug
ping
read_memory
run_app
shell
version
write_memory
---[HeapManager] [docsis_ctl] [embedded_target] [flash] [non-vol]

dir
ls
system_time
reset
zone

CM>
***
*** VERBINDUNGSABBRUCH
*** Uhrzeit 15:08:18
***
[TELNET] INFO: DISCONNECTED
***
*** VERBINDUNG: 192.168.200.1:23
*** Datum 09.04.2014
*** Uhrzeit 17:17:28
***
Haxorware integrated telnet daemon
Username: root
Password: ************
Welcome.
CM>
CM> ls -l /var/tmp
COMMAND: !
USAGE: ! [Number{0..15}] [command{31}]
DESCRIPTION:
Executes the last command that was entered. If a command (or history number)
is specified, then it executes that command from the history buffer. This
works like the Unix '!' command
EXAMPLES:
!
-- This repeats the last command that was entered.
! cd -- This repeats the last 'cd' command that was entered.
----------------------------------------------------------------------------COMMAND: ?
USAGE: ? [-t|-l|-s|-i|-a|-lr] [command [...]{126}]
DESCRIPTION:
Alias for 'help'. Type 'help help' for more information.

EXAMPLES:
No examples available...
----------------------------------------------------------------------------COMMAND: REM
USAGE: REM [Remark text{126}]
DESCRIPTION:
Ignores the text that follows; used for remarks, scripting, etc.
EXAMPLES:
REM Started test here. -----------------------------------------------------------------------------COMMAND: cd
USAGE: cd [subtable | .. | \ | /{31}]
DESCRIPTION:
Sets the specified command table as the active table. This works like the
DOS or Unix 'cd' command where '..' takes you to the previous table, and '\'
or '/' takes you to the root table. If no parameters are specified, then it
shows the name of the currently active command table.
EXAMPLES:
cd classifiers
cd \
cd ..
cd
cd \non\doc

------

Makes the specified subtable the active command table.


Makes the main command table active.
Makes the previous (parent) command table active.
Shows the name of the active command table.
You can specify partial names, and mutliple subdirs.

----------------------------------------------------------------------------COMMAND: dir
USAGE: dir [-t|-l|-s|-i|-a|-lr] [command [...]{126}]
DESCRIPTION:
Alias for 'help'. Type 'help help' for more information.
EXAMPLES:
No examples available...
----------------------------------------------------------------------------COMMAND: find_command
USAGE: find_command command{31}
DESCRIPTION:
Displays the name of all subdirectories which contain the specified command.
EXAMPLES:
find_command show ------------------------------------------------------------------------------

COMMAND: help
USAGE: help [-t|-l|-s|-i|-a|-lr] [command [...]{126}]
DESCRIPTION:
Shows usage information about the specified command(s), or lists the set of
commands available in the active table. If no parameters are specified, then
an abbreviated list of all commands and subtables is displayed.
-t -- Shows the entire tree of command tables and commands (in
abbreviated form).
-l -- Shows detailed information about all commands and subtables (this
can print a LOT of information)!
-s -- Shows detailed information on just the subtables.
-i -- Shows detailed information on just the registered instances for
the active table.
-a -- Does everything that the -l, -s, and -i options do.
Command is the name (or partial name) of one or more commands and subtables
for which you want detailed help to be displayed.
EXAMPLES:
help

-- This shows an abbreviated list of all commands and


subtables.
help cd
-- This shows detailed help on the 'cd' command.
help cd ! diag -- This shows detailed help on the 2 commands and subtable
listed.
help -l
-- Shows detailed help on all available commands and
subtables.
----------------------------------------------------------------------------COMMAND: history
USAGE: history
DESCRIPTION:
Shows a list of commands that were previously typed.
EXAMPLES:
history -----------------------------------------------------------------------------COMMAND: instances
USAGE: instances [name{31}]
DESCRIPTION:
Shows the set of object instances that have registered with the active table.
This is the same as 'help -i', except that it lets you specify a partial
instance name in order to limit the list that is displayed (only instances
whose names match the partial string are shown). The name is not case
sensitive.
EXAMPLES:
instances
-- Shows all instances registered with the command table.
instances p -- Shows all instances whose name begins with 'p' or 'P'.
-----------------------------------------------------------------------------

COMMAND: ls
USAGE: ls [-t|-l|-s|-i|-a|-lr] [command [...]{126}]
DESCRIPTION:
Alias for 'help'. Type 'help help' for more information.
EXAMPLES:
No examples available...
----------------------------------------------------------------------------COMMAND: man
USAGE: man [-t|-l|-s|-i|-a|-lr] [command [...]{126}]
DESCRIPTION:
Alias for 'help'. Type 'help help' for more information.
EXAMPLES:
No examples available...
----------------------------------------------------------------------------COMMAND: pwd
USAGE: pwd
DESCRIPTION:
Shows the name of the currently active command table. This is like the Unix
'pwd' command.
EXAMPLES:
pwd -----------------------------------------------------------------------------COMMAND: sleep
USAGE: sleep Milliseconds
DESCRIPTION:
Causes the console to sleep for the specified number of milliseconds. This
is useful for scripting, where you want to delay between commands.
EXAMPLES:
sleep 1000 -- Makes the console sleep for 1 second
----------------------------------------------------------------------------COMMAND: syntax
USAGE: syntax
DESCRIPTION:
Displays detailed information on command line syntax and how the parser
works.
EXAMPLES:

syntax -----------------------------------------------------------------------------COMMAND: system_time


USAGE: system_time
DESCRIPTION:
Displays the current system millisecond tick counter.
EXAMPLES:
system_time -----------------------------------------------------------------------------COMMAND: usage
USAGE: usage
DESCRIPTION:
Displays information about how the console works, and how to use it.
EXAMPLES:
usage -----------------------------------------------------------------------------COMMAND: con_high
USAGE: con_high
DESCRIPTION:
Boosts the console thread priority so that you can use the console while the
system is busy. Normally, the console priority is low so that it doesn't
interfere with normal system operation.
EXAMPLES:
con_high -----------------------------------------------------------------------------COMMAND: mbufShow
USAGE: mbufShow
DESCRIPTION:
Displays current mbuf allocation.
EXAMPLES:
mbufShow -----------------------------------------------------------------------------COMMAND: memShow
USAGE: memShow
DESCRIPTION:
Displays current memory allocation.

EXAMPLES:
memShow -----------------------------------------------------------------------------COMMAND: mutex_debug
USAGE: mutex_debug
DESCRIPTION:
Shows mutex debug information for debugging deadlocks.
EXAMPLES:
mutex_debug
----------------------------------------------------------------------------COMMAND: ping
USAGE: ping IpAddress
DESCRIPTION:
Pings the specified target IP address, sending 3 64-byte packets, and waiting
up to 5 seconds for a response. This is a basic 'standard' ping. For more
options or control over ping parameters and behavior, you will need to go to
the Ping Command table ('cd pingHelper').
In order for this to work, the CM must either have successfully completed
DHCP, or must otherwise have been configured with a valid IP address.
Note that this command causes the ping options to be reset to their default
state.
This may be disabled if the platform doesn't provide an implementation of
ping.
EXAMPLES:
ping 11.24.4.3 -- Ping IP address 11.24.4.3.
----------------------------------------------------------------------------COMMAND: read_memory
USAGE: read_memory [-p] [-c] [-s ElementSize{1..4}] [-n NumberOfBytes{1..16384
}] [StartAddress]
DESCRIPTION:
Displays the contents of memory (in hex and ASCII) to the console.
StartAddress : the address to start displaying (can be memory, registers,
etc).
-s : sets the element size to be read (1, 2, or 4 bytes). Most useful for
registers; defaults to 1.
-n : sets the number of bytes to be read. Defaults to 16. Note that this
will always be padded out to a multiple of the element size.
-c : increments the start address by the number of bytes before reading.
This is most useful for continuing the previous read (with the same
parameters).
-p : prints the current options (which would be used if not otherwise

supplied).
If no parameters are specified, it will perform the last read again.
NOTE - the parameters are remembered from one read to the next; e.g. if you
set the element size to 4 bytes, then all subsequent reads will use this,
unless explicitly overridden.
ize.
-c : increments the start address by the number of bytes before reading.
This is most useful for continuing the previous read (with the same
parameters).
-p : prints the current options (which would be used if not otherwise
supplied).
If no parameters are specified, it will perform the last read again.
NOTE - the parameters are remembered from one read to the next; e.g. if you
set the element size to 4 bytes, then all subsequent reads will use this,
unless explicitly overridden.
WARNING - it may be possible to make the system hang or crash if you read
from an illegal address!
EXAMPLES:
read_memory -s 4 -n 64 0x80001234 -- Reads 64 bytes as 32-bit values.
read_memory -n 32 0x80001234
-- Reads 32 bytes starting with the
specified address.
read_memory -c
-- Reads the next 32 bytes, continuing
from the previous read.
----------------------------------------------------------------------------COMMAND: reset
USAGE: reset
DESCRIPTION:
Causes the application to exit, shutting everything down and cleaning up
resources. On embedded platforms, this usually also triggers the internal
CPU reset logic, causing the h/w to reboot.
EXAMPLES:
reset -----------------------------------------------------------------------------COMMAND: routeShow
USAGE: routeShow
DESCRIPTION:
Displays current routing information.
EXAMPLES:
routeShow -----------------------------------------------------------------------------COMMAND: run_app

USAGE: run_app
DESCRIPTION:
If the application was stopped at the console (either via keypress or via
non-vol setting that automatically stopped it), then this command will allow
it to start running. If the application is already running, this will cause
it to start over again.
EXAMPLES:
run_app -----------------------------------------------------------------------------COMMAND: shell
USAGE: shell
DESCRIPTION:
Causes the application to jump to eCos shell.
EXAMPLES:
shell -----------------------------------------------------------------------------COMMAND: stackShow
USAGE: stackShow
DESCRIPTION:
Displays current tasks stack information.
EXAMPLES:
stackShow -----------------------------------------------------------------------------COMMAND: taskDelete
USAGE: taskDelete
DESCRIPTION:
Deletes a specific task.
EXAMPLES:
taskDelete -----------------------------------------------------------------------------COMMAND: taskInfo
USAGE: taskInfo
DESCRIPTION:
Displays a specific task information.
EXAMPLES:
taskInfo ------------------------------------------------------------------------------

COMMAND: taskPrioritySet
USAGE: taskPrioritySet
DESCRIPTION:
Changes a specific task priority.
EXAMPLES:
taskPrioritySet -----------------------------------------------------------------------------COMMAND: taskResume
USAGE: taskResume
DESCRIPTION:
Resumes a specific task.
EXAMPLES:
taskResumes -----------------------------------------------------------------------------COMMAND: taskShow
USAGE: taskShow
DESCRIPTION:
Displays current tasks information.
EXAMPLES:
taskShow -----------------------------------------------------------------------------COMMAND: taskSuspend
USAGE: taskSuspend
DESCRIPTION:
Suspends a specific task.
EXAMPLES:
taskSuspend -----------------------------------------------------------------------------COMMAND: taskTrace
USAGE: taskTrace
DESCRIPTION:
Displays a stack trace of a task.
EXAMPLES:
taskTrace ------------------------------------------------------------------------------

COMMAND: usfsShow
USAGE: usfsShow
DESCRIPTION:
Displays the current USFS Table.
EXAMPLES:
usfsShow -----------------------------------------------------------------------------COMMAND: version
USAGE: version
DESCRIPTION:
Displays the current software version and feature codes by printing the
startup banner. This allows the user to view the current version information
without having to restart the application.
EXAMPLES:
version -----------------------------------------------------------------------------COMMAND: write_memory
USAGE: write_memory [-s ElementSize{1..4}] Address Value
DESCRIPTION:
Writes the specified value to the specified address.
Address : the address to write to (can be memory, registers, etc).
Value : the value to write.
-s
: sets the element size to be written (1, 2 or 4 bytes). If not
specified, the default is 1 byte.
NOTE - unlike read_memory, the parameters are not remembered from one write
to the next.
WARNING - it is possible to make the system hang or crash if you write to an
illegal address (or write over the application code)!
EXAMPLES:
write_memory 0x80001234 0x56
-- Write a byte to the address.
write_memory -s 4 0x80001234 0x12345678 -- Write 32 bits.
----------------------------------------------------------------------------COMMAND: zone
USAGE: zone [Bitmask{0xffff}]
DESCRIPTION:
Prints or sets the HAL debug zones; this determines what debug messages will
be displayed by HAL drivers. These bits correspond to the HAL debug zones:
0x0001 -- INIT
0x0002 -- TEST1

0x0004
0x0008
0x0010
0x0020
0x0040
0x0080
0x0100
0x0200
0x0400
0x0800
0x1000
0x2000
0x4000
0x8000

---------------

TEST2
TEST3
TEST4
TEST5
TEST6
BPI
DOWNSTREAM
UPSTREAM
TUNER
RANGING
TESTSRAM
TESTREG
WARNING
ERROR

EXAMPLES:
zone 0xc000 -- Enables ERROR and WARNING levels.
----------------------------------------------------------------------------Command Table: HeapManager Commands (HeapManager)
Description:
Broadcom Heap Manager (malloc/free) settings and commands.
----------------------------------------------------------------------------Command Table: CM DOCSIS HAL Commands (cm_hal)
Description:
Commands to show/change the CM DOCSIS HAL state.
----------------------------------------------------------------------------Command Table: CM DOCSIS Control Thread Commands (docsis_ctl)
Description:
Commands to change the state of the DOCSIS Control thread.
----------------------------------------------------------------------------Command Table: Embedded Target Commands (embedded_target)
Description:
Commands to control the embedded target platform.
----------------------------------------------------------------------------Command Table: Ethernet HAL Commands (enet_hal)
Description:
Commands to show/change the Ethernet HAL state.
-----------------------------------------------------------------------------

Command Table: Event Log commands (event_log)


Description:
Commands to manipulate the Event Log
----------------------------------------------------------------------------Command Table: Flash Driver Commands (flash)
Description:
Commands to control the flash device driver.
----------------------------------------------------------------------------Command Table: Forwarder Commands (forwarder)
Description:
Commands to show/change the Forwarder state.
----------------------------------------------------------------------------Command Table: IP Stack HAL Commands (ip_hal)
Description:
Commands to manage IP stacks and related tasks.
----------------------------------------------------------------------------Command Table: Message Log Settings Commands (msgLog)
Description:
Commands for changing Message Log Settings. These commands allow you enable
and disable display fields and severity levels for individual objects or for
groups of objects.
----------------------------------------------------------------------------Command Table: Non-Volatile Settings Commands (non-vol)
Description:
Commands to change the non-volatile settings for the application.
----------------------------------------------------------------------------Command Table: Ping Commands (pingHelper)
Description:
Ping Helper Thread settings and commands. These commands allow you to set the
ping utility up with precise control over packet sizes, timeout values, etc.
----------------------------------------------------------------------------Command Table: SNMP Commands (snmp)

Description:
SNMP commands.
----------------------------------------------------------------------------Command Table: Snoop Commands (snoop)
Description:
Commands to show/change the state of Snoop objects.
----------------------------------------------------------------------------Command Table: USB HAL Commands (usb_hal)
Description:
Commands to show/change the USB HAL state.
----------------------------------------------------------------------------CM> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]
CM> cd ds
Specified subtable ('ds') doesn't exist! Can't change to it...
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> cd docsis_ctl
Active Command Table: CM DOCSIS Control Thread Commands (docsis_ctl)
CM -> docsis_ctl
CM/DocsisCtl> dir
!
find_command
man

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

usage
---ClearCmCert
binarySfid
bpiShow
clear_image
comp_mac_to_phy comp_phy_to_mac
dsdiag
dsx_show
goto_ds
ip_initialize ip_show
l2vpn_show
modem_caps
rate_shaping_enable
showFlows
state
stop_download
up_dis
us_phy_oh_show usdiag
---[dsxTest] [propane_ctl]

cfg_hex_show
copy_image
goto_us
log_messages
rng_rsp
ucdShow

cfg_tlv_show
dload
igmpShow
map_debug
scan_stop
ucddiag

cd
instances
syntax

dir
ls
system_time

cfg_hex_show
copy_image
goto_us
log_messages
rng_rsp
ucdShow

cfg_tlv_show
dload
igmpShow
map_debug
scan_stop
ucddiag

CM/DocsisCtl> ls
!
?
REM
find_command
help
history
man
pwd
sleep
usage
---ClearCmCert
binarySfid
bpiShow
clear_image
comp_mac_to_phy comp_phy_to_mac
dsdiag
dsx_show
goto_ds
ip_initialize ip_show
l2vpn_show
modem_caps
rate_shaping_enable
showFlows
state
stop_download
up_dis
us_phy_oh_show usdiag
---[dsxTest] [propane_ctl]
CM/DocsisCtl> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> cd nvram
Specified subtable ('nvram') doesn't exist! Can't change to it...
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]

CM> cd non-vol
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data flush
manufactured
read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> cd Motorola
Active Command Table: CM Motorola NonVol Commands (Motorola)
CM -> non-vol -> Motorola
CM/NonVol/CM Motorola NonVol> ls
!
find_command
man
usage
---clear_device
defaults
manufactured
tftp_read
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

cli_enable
del_extra_data
read
tftp_write

cm_amp
dhcp_enable
rg_enable
write

cm_hwrev
{flush}
show

cm_tuner
html_ro_enable
stats

CM/NonVol/CM Motorola NonVol> show


COMMAND: show
USAGE: show
DESCRIPTION:
Displays the current non-volatile settings values for both the Permanent and
Dynamic sections.
EXAMPLES:
show ---------------------------------------------------------------------------CM/NonVol/CM Motorola NonVol> show
+--------------------------------------+
| CM Vendor (Motorola) NonVol Settings |
+--------------------------------------+

Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x4d4f544f 'MOTO'
0.6
0.13
0
0
1
1

NOTE: 'Shadowed' settings are stored in a different NonVol group. Modifying


these settings actually modifies that group; access to these items is
provided here for convenience.
Motorola Permanent NonVol Settings:
cmFactoryResidentialGatewayEnable
cmFreqPlanType
cmDhcpServerEnable
cmCfgConcatEnabled
cmDocsis20Capable
cmAnnexMode
cmBabbleControl
cmDhcpServerEnable
cmQam256PowerFactorTableVersion
cmQam256PowerFactorArray
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

=
=
=
=
=
=
=
=
=
=

0
1
1
1
1
1
0
1
0

(shadowed from DOCSIS nonvol)


(shadowed from DOCSIS nonvol)
(shadowed from HAL IF nonvol)
(0)

00 00 00 00 | ................
00 00 00
| ...............

cmFactoryCalibrationFrequencyData = {suppressed for brevity}


cmFactoryDbgBootEnable = 0 (shadowed from BfcApp, Auto Conso
le)
cmFactoryEnetMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)
cmFactoryHfcMacAddr = 00:11:e3:aa:eb:08 (shadowed from Ha
lIf, IP1 MAC Addr)
cmFactorySetReset
cmFactorySerialNumber
SNMP, docsDevSerialNumber)
cmFactoryCliFlag
cmFactoryDisableMib
{inverted})
cmFactoryUpstreamPowerCalibration1
cmFactoryDownstreamCalibrationTableMaxSum
cmFactoryDownstreamCalibrationTableMinSum
cmFactoryBigRSAPublicKey
from BPI, BPI Public Key)
cmFactoryBigRSAPrivateKey
from BPI, BPI Private Key)
cmFactoryCMCertificate
from BPI, BPI+ CM Certificate)
cmFactoryManCertificate
from BPI, BPI+ CA Certificate)
cmFactoryRootPublicKey
from BPI, BPI+ Root Public Key)
cmFactoryCMManufacturerName
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

= 0
= '00968 - 142404658' (shadowed from
= 1
= 1 (shadowed from SNMP, AllowConfig
=
=
=
=

0xffffffef (4294967279)
0 (0)
0 (0)
{suppressed for brevity} (shadowed

= {suppressed for brevity} (shadowed


= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
=
00 00 00 00 | ................
| ........

cmFactoryHtmlReadOnly = 0
cmFactoryCmUsbMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)

cmFactoryCpeUsbMacAddr = 00:11:e3:aa:eb:02 (shadowed from Ha


lIf, USB MAC Addr)
cmFactoryCmAuxMacAddr = 00:20:40:de:ad:03 (shadowed from Ha
lIf, IP3 MAC Addr)

00
00
00
00
00
00
00
00
00

cmFactoryTunerId
cmFactoryHwRevision
cmFactoryUsAmpId
cmFactoryTop
cmFactoryDownstreamCalibrationOffset
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppPublicKey
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppPrivateKey
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

=
=
=
=
=

4
0x1 (1)
4
0
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
............

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
....

00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00

00
00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

|
|
|
|
|

................
................
................
................
..

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppRootPublicKey
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
....

cmFactoryFWFeatureID = 0
Motorola Dynamic NonVol Settings:
cmFreqPlanType = 1
cmDhcpServerEnable = 1
cmCfgConcatEnabled = 1
cmDocsis20Capable = 1
cmAnnexMode = 3
cmBabbleControl = 0
cmConfigFreq1 = 666000000 Hz (shadowed from DOCSIS, DsFreq)
cmConfigFreq2 = 642000000 Hz
cmConfigFreq3 = 650000000 Hz
cmUpstreamChannelId1 = 3 (shadowed from DOCSIS, UsChan)
cmUpstreamChannelId2 = 16
cmUpstreamChannelId3 = 1
cmUpstreamPower1 = 53.50 dBmV (shadowed from DOCSIS, UsPower)
cmUpstreamPower2 = 54.0 dBmV
cmUpstreamPower3 = 54.0 dBmV
cmFactoryCodeSigningTime = (shadowed from BPI, Code Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactoryCVCValidityStartTime = (shadowed from BPI, CVC Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactorySwServer = 0.0.0.0 (shadowed from SNMP, docsDevSwServer)
cmFactorySwFilename = (unknown) (shadowed from SNMP, docsDevSwFilen
ame)
cmStandbyMode = 0

cmStandbyCapable = 0
cmSunboxCapable = 0
cmDhcpUnicastTrafficOnly = 0
cmConfigGuiHfcAccessEnable = 0
cmConfigEnableAllEventLogPriorities = 0
cmConfigT3TimeoutInitRngRetries = 
fCmFreqCustomListEntries = 0
fCmDocsis1xHackFor20CmtsEnable = 0
fDocsDevSTPControl = 
fCmClearUpstreamFavChanID = 0
CM/NonVol/CM Motorola NonVol> ls
!
find_command
man
usage
---clear_device
defaults
manufactured
tftp_read
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

cli_enable
del_extra_data
read
tftp_write

cm_amp
dhcp_enable
rg_enable
write

cm_hwrev
{flush}
show

cm_tuner
html_ro_enable
stats

CM/NonVol/CM Motorola NonVol> cd ..


Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data flush
manufactured
read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> show
+---------------------------------+
| BFC Application NonVol Settings |
+---------------------------------+
Magic Number = 0x434d4170 'CMAp'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
CM Application Permanent NonVol Settings:

Automatically stop at console = 0


CM/NonVol> show
+---------------------------------+
| BFC Application NonVol Settings |
+---------------------------------+
Magic Number = 0x434d4170 'CMAp'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
CM Application Permanent NonVol Settings:
Automatically stop at console = 0
'Skip driver init' Prompt Enabled = 0
'Stop at console' Prompt Enabled = 0
CM Application Dynamic NonVol Settings:
Serial console mode = readWrite
+--------------------------------+
| User Interface NonVol Settings |
+--------------------------------+
Magic Number = 0x4d4c6f67 'MLog'
Version (Permanent) = 0.2
Version (Dynamic) = 0.4
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
User Interface Dynamic NonVol Settings:
HTTP User ID = ''
HTTP User Password = 'Motorola'
HTTP Admin ID = '(DISABLED)'
HTTP Admin Password = '(DISABLED)'
Remote Access User Name = ''
Remote Access Password = ''
Remote Access inactivity timeout = '0'
Telnet Access Enabled = 0
Telnet IP Stack enable = 0x3 (IP2|IP1)
SSH Access Enabled = 0
SSH IP Stack enable = 0x3 (IP2|IP1)
HTTP Access Enabled = 0
HTTP IP stack enable = 0x2 (IP2)
HTTP Advanced IP stack enable = 0 ({None})
HTTP Password Seed = ''
HTTP Remote IP ACL (emtpy == allow all)::
HTTP Password Idle Timeout = 0
User Interface Permanent NonVol Settings:
Default Severities = 0x7 (Warnings | Errors | Fatal Errors)

Default Fields = 0x3f (Thread Id | Timestamps | Module/Class N


ame | Function/Method Name | Instance Name | Severity)
Remote Access IP address = 192.168.200.1
Remote Access Subnet Mask = 255.255.255.0
Remote Access Router address = 192.168.200.254
Remote Access IP Stack Number = 2
+-----------------------+
| HalIf NonVol Settings |
+-----------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0xf2a1f61f '....'
0.17
0.0
0
0
1
1

HAL Interface Permanent NonVol Settings:


Enabled Interfaces = 0x3b (IP2 IP1 USB Ethernet DocsisCm)
MAC
MAC
MAC
MAC
MAC
MAC
MAC
MAC

address
address
address
address
address
address
address
address

for
for
for
for
for
for
for
for

IP
IP
IP
IP
IP
IP
IP
IP

Stack
Stack
Stack
Stack
Stack
Stack
Stack
Stack

1
2
3
4
5
6
7
8

=
=
=
=
=
=
=
=

00:11:e3:aa:eb:08
00:11:e3:aa:eb:01
00:20:40:de:ad:03
00:20:40:de:ad:04
00:20:40:de:ad:05
00:20:40:de:ad:06
00:20:40:de:ad:07
00:20:40:de:ad:08

Default HAL Debug Zones = 0 ({None})


Board Rev = 18 (BCM93345)
USB HAL Settings:
---------------USB Vendor Id =
USB Device Id =
USB MAC address =
USB Rndis Driver Enabled

0x7b2
0x5101
00:11:e3:aa:eb:02
= 0

Bluetooth HAL Settings:


----------------------Local Mac Address = 00:20:40:de:ad:0a
Remote Mac Address = 00:20:40:de:ad:0b
Master Enabled = 0
Ethernet HAL Settings:
--------------------Autonegotiate Enabled
Default Link Speed
Default Link Full Duplex
Reject CAM Enabled

=
=
=
=

1
10 Mbps
0
1

HPNA HAL Settings:


----------------Default Message Level = 1
CM HAL Settings:

--------------Downstream Tuner Type = 19 (BCM3419)


Upstream Amp Type = 9 (BCM INTERNAL AMP)
Downstream Reference Frequency = 30000000 hz
Upstream Reference Frequency = 24000000 hz
Input Frequency to PHY = 5000000 hz
Annex Mode = ANNEX A
Spreader Scale = 1
Upstream Sample Frequency = 480000000 hz
1024QAM Enabled = 1
Use DOCSIS 2.0 Clipping = 1
Proprietary SCDMA Code Matrix Enabled = 0
Advance Map RunAhead Enabled = 1
Upstream Priority Queue Support Enable = 1
DS_AGI = 0xd
DS_AGT = 0x1d
STATHR = 0x400
STAGI = 0
STPGA1 = 0x20042
STAGT = 0xfff00000
STABW1 = 0xd0b
STABW2 = 0x409
Number of SHACK Tries = 3
Power save mode enabled = 0
Optimized 3420 frequency map enabled = 1
High output PA enabled = 0
Board HAL Settings:
-----------------Watchdog Enabled = 1
Watchdog Timeout = 15 secs

0:
1:
2:
3:
4:
5:

BcmAlloc Settings:
----------------Buffer Size ( 16)
Buffer Size ( 48)
Buffer Size ( 160)
Buffer Size ( 288)
Buffer Size (1536)
Buffer Size (1648)
-----------------Total (approx) RAM

=
=
=
=
=
=

32 buffers
32 buffers
64 buffers
200 buffers
4 buffers
400 buffers
-----------= 718 kbytes

+-------------------------+
| Factory NonVol Settings |
+-------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x46414354 'FACT'
0.2
0.1
0
0
1
1

Broadcom Factory Extension Permanent NonVol Settings:


Private MIB enable: 0
Temporary MIB enable key allowed: 1
Enable Key 0:
Enable Key 1:

Enable Key
Enable Key
Enable Key
Enable Key
Enable Key
Enable Key
Serial Number
Serial Number
Serial Number
Serial Number

2:
3:
4:
5:
6:
7:
0:
1:
2:
3:

Broadcom Factory Extension Dynamic NonVol Settings:


Scratch Pad: 0
+------------------------+
| CM BPI NonVol Settings |
+------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x62706920 'bpi '


0.1
0.2
0
0
1
1

BPI Permanent NonVol Settings: (Values suppressed for brevity)


BPI Public Key
BPI Private Key
BPI+ Root Public Key
BPI+ CM Certificate
BPI+ CA Certificate

=
=
=
=
=

(963 bytes)
(636 bytes)
(914 bytes)
(1422 bytes)
(992 bytes)

BPI Dynamic NonVol Settings:


Secure Software Download settings:
Code Access Start =
30 30 30 31 30 31 30 30

30 30 30 30 | 000101000000

CVC Access Start =


30 30 30 31 30 31 30 30

30 30 30 30 | 000101000000

Co-Signing Agent Name = ''


Upgraded BPI+ Key settings: (Values suppressed for brevity)
Root Public Key upgraded
CA Certificate upgraded
Upgraded Root Public Key
Upgraded CA Certificate

=
=
=
=

+---------------------------+
| CM DOCSIS NonVol Settings |
+---------------------------+
Magic Number =
Version (Permanent) =
Version (Dynamic) =
Is Default (Permanent) =

0
0
(0 bytes)
(0 bytes)

0xd0c20100 '....'
0.4
0.4
0

Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
DOCSIS Cable Modem Permanent NonVol Settings:
Scan Single DsChan Enabled = 0
BPI Enabled = 0
Concatenation Enabled = 1
Fragmentation Enabled = 1
PHS Enabled = 1
IGMP Enabled = 1
Rate Shaping Enabled = 1
DOCSIS 1.1 Features Enabled = 1
DHCP Enabled = 1
Time Of Day Enabled = 1
Config File TFTP Enabled = 1
Canned Registration Enabled = 0
One-line RNG-RSP Enabled = 0
Advanced PHY Enabled = 1
DOCSIS 2.0 Hack for 1.x CMTS = 0
BPI23 (secure s/w dload) Enabled = 0
Optimized Initial Ranging Enabled = 1
Force Config File Enabled = 0
AckCel technology Enabled = 1
NonStandard Upstream Enabled = 0
Upstream Queues Enabled = 0 (all queues can be used)
BPI Version = 0
Disabled DOCSIS Timers = 0xf (T4 T3 T2 T1)
Concatenation Threshold = 2 packets
Rate Shaping Time Interval = 2 seconds
TFTP Retry Timeout = 20 seconds
IP Stack Number = 1
Max UGS Queue Depth = 3 packets {deprecated}
Max Concat Packets = 128 packets
Ranging Class = 0x1

0
1
2
3

Max UGS Queue Depth Settings:


---------------------------0..150
uSec : 32 packets
151..250
uSec : 8 packets
251..500
uSec : 4 packets
501..65535 uSec : 3 packets

If DHCP is not enabled, then the following settings will be used:


DHCP Settings:
My offered IP address
Subnet Mask
Router IP address
TFTP Server IP address
CM Configuration file
Time Server IP address
Log Server IP address

=
=
=
=
=
=
=

10.10.10.10
255.255.255.0
10.10.10.254
10.175.0.1
'kfoA,.iyewrkldJKDHSUBsgv'
10.175.0.1
10.10.10.254

DOCSIS Cable Modem Dynamic NonVol Settings:


Downstream Frequency = 666000000 hz
Upstream Channel = 3
Upstream Power = 214 quarter dBmV (53.50 dBmV)

Docsis10IgmpSupportEnabled = 1
Docsis10IgmpMulticastPromiscEnabled = 1
Startup Target DsFreq = 0 hz
Startup Target UsChannel = 0
Startup Target Context = 0
Ranging Class Extension = 0
+-------------------------------------+
| CableModem EventLog NonVol Settings |
+-------------------------------------+
Magic Number = 0x434d4556 'CMEV'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Permanent Settings:
(there are no permanent event log settings)
Dynamic Settings:
Capacity = 100
Next available = -1
Event#
Id
------ -------------0
68000100
1
82000400
2
2300955924
3
2300955728
4
2300955725
5
68000100
6
82000400
7
2300955924
------ -------------0
68000100
1
82000400
2
2300955924
3
2300955728
4
2300955725
5
68000100
6
82000400
7
2300955924
8
2300955728
9
2300955725
10
68000100
11
82000400
12
2300955924
13
2300955728
14
2300955725
15
68000100
16
82000400
17
2300955924
18
2300955725
19
68000100
20
82000400
21
2300955924

events
Count
----5
1
1
1
1
6
1
1
----5
1
1
1
1
6
1
1
1
1
5
1
1
1
1
17
1
1
1
17
1
1

FirstTime
--------1396970368
1396970552
1396970552
2
5
22
207
207
--------1396970368
1396970552
1396970552
2
5
22
207
207
2
5
20
204
204
2
5
19
604
604
2
18
607
607

LastTime
-------1396970492
1396970552
1396970552
2
5
206
207
207
-------1396970492
1396970552
1396970552
2
5
206
207
207
2
5
144
204
204
2
5
544
604
604
2
548
607
607

22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

2300955728
2300955725
68000300
73040100
2300955824
68000300
73040100
2436694044
2300955924
2300955725
68000300
2436694044
2300955924
2300955725
68000300
2436694044
2300955924
2300955725
68000300
68010300
2436694044
2300955924
2300955725
68000300
2436694044
2300955924
2300955725
68000300
68000500
2436694044
2300955924
2300955725
68000300
68000500
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2300955824
68000300
73000100
2300955824
82000200
82000200

1
1
1
4
1
1
4
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
2
2

2
5
21
1396972624
1396972624
1396972638
1396972644
1397052773
1397052773
6
19
1397053016
1397053016
6
19
1397053179
1397053179
5
18
1397055006
1397055497
1397055497
5
18
1397056897
1397056897
6
19
1397057025
1397057052
1397057052
5
21
1397057183
1397057190
1397057190
6
19
1397057224
1397057280
1397057280
6
17
1397057316
1397058043
1397058043
6
17
1397058078
1397058248
1397058248
6
19
1397058285
1397058285
1397058298
1397058307
1397058307
1397058312
1397058330

2
5
21
1396972624
1396972624
1396972638
1396972644
1397052773
1397052773
6
19
1397053016
1397053016
6
19
1397053179
1397053179
6
18
1397055006
1397055497
1397055497
6
18
1397056897
1397056897
6
19
1397057025
1397057052
1397057052
6
21
1397057183
1397057190
1397057190
6
19
1397057224
1397057280
1397057280
6
17
1397057316
1397058043
1397058043
6
17
1397058078
1397058248
1397058248
6
19
1397058285
1397058285
1397058298
1397058307
1397058307
1397058314
1397058333

82
68000300
2 1397058349
18
83
73000100
1 1397058704 1397058704
84
2436694044
1 1397059081 1397059081
85
2300955924
1 1397059081 1397059081
86
2300955725
1
5
6
87
82000400
1
43
43
88
2300955924
1
43
43
89
2300955725
1
6
6
90
82000200
17
12
117
91
82000300
1
117
117
92
2436694044
1
144
144
93
2300955924
1
144
144
94
82000200
9
10
58
95
2436694044
1
60
60
96
2300955924
1
60
60
97
2300955725
1
6
6
98
68000300
1
18
18
99
82000500
1 1397060234 1397060234
Event Text:
0: DHCP FAILED - Discover sent, no offer received
1: Received Response to Broadcast Maintenance Request, But no Unicast Maintenanc
e opportunities received - T4 timeout
2: Modem Is Shutting Down and Rebooting...
3: Ethernet link dormant - not currently active
4: Ethernet link up - ready to pass packets
5: DHCP FAILED - Discover sent, no offer received
6: Received Response to Broadcast Maintenance Request, But no Unicast Maintenanc
e opportunities received - T4 timeout
7: Modem Is Shutting Down and Rebooting...
8: Ethernet link dormant - not currently active
9: Ethernet link up - ready to pass packets
10: DHCP FAILED - Discover sent, no offer received
11: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
12: Modem Is Shutting Down and Rebooting...
13: Ethernet link dormant - not currently active
14: Ethernet link up - ready to pass packets
15: DHCP FAILED - Discover sent, no offer received
16: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
17: Modem Is Shutting Down and Rebooting...
18: Ethernet link up - ready to pass packets
19: DHCP FAILED - Discover sent, no offer received
20: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
21: Modem Is Shutting Down and Rebooting...
14: Ethernet link up - ready to pass packets
15: DHCP FAILED - Discover sent, no offer received
16: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
17: Modem Is Shutting Down and Rebooting...
18: Ethernet link up - ready to pass packets
19: DHCP FAILED - Discover sent, no offer received
20: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
21: Modem Is Shutting Down and Rebooting...
22: Ethernet link dormant - not currently active
23: Ethernet link up - ready to pass packets
24: DHCP WARNING - Non-critical field invalid in response.
25: TLV-11 - unrecognized OID

26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:

Neg Or Bad Reg Rsp - Reinitialize MAC...


DHCP WARNING - Non-critical field invalid in response.
TLV-11 - unrecognized OID
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
DHCP RENEW WARNING - Field invalid in response
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
TFTP failed - request sent - No Response
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
TFTP failed - request sent - No Response
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...
Ethernet link up - ready to pass packets
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Neg Or Bad Reg Rsp - Reinitialize MAC...
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Neg Or Bad Reg Rsp - Reinitialize MAC...
No Ranging Response received - T3 time-out (US 4)
No Ranging Response received - T3 time-out (US 3)
DHCP WARNING - Non-critical field invalid in response.
REG-RSP - invalid format or not recognized
Resetting the cable modem due to docsDevResetNow
Modem Is Shutting Down and Rebooting...

86: Ethernet link up - ready to pass packets


87: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
88: Modem Is Shutting Down and Rebooting...
89: Ethernet link up - ready to pass packets
90: No Ranging Response received - T3 time-out (US 3)
91: Init RANGING Critical Ranging Request (17) Retries exhausted
92: Resetting the cable modem due to docsDevResetNow
93: Modem Is Shutting Down and Rebooting...
94: No Ranging Response received - T3 time-out (US 3)
95: Resetting the cable modem due to docsDevResetNow
96: Modem Is Shutting Down and Rebooting...
97: Ethernet link up - ready to pass packets
98: DHCP WARNING - Non-critical field invalid in response.
99: Started Unicast Maintenance Ranging - No Response received - T3 time-out
+-------------------------+
| CM SNMP NonVol Settings |
+-------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x736e6d70 'snmp'
0.4
0.6
0
0
1
1

CM SNMP Permanent NonVol Settings:


AllowConfiguration =
Vendor Name =
sysDescr =
SW_REV: 1.1; MODEL: THG571>>
sysObjectID =
sysORID.1 =
sysORDescr.1 =
ment
sysServices =
docsDevSwCurrentVers =
docsDevSerialNumber =
Max Download Tries =
Disable diag agent post-reg =
Hide IP stack ifEntries =

0
Thomson THG571
<<HW_REV: 1; VENDOR: Thomson THG571; BOOTR: 2164;
1.3.6.1.4.1.1166.0.1.0.0.0.0.0
1.3.6.1.4.1.1166.1.20
Motorola Cable Modem SNMP Agent Capabilities State
0x4f
1.1
00968 - 142404658
4
0
1

CM SNMP Dynamic NonVol Settings:


sysContact
sysName
sysLocation
docsDevSwAdminStatus
docsDevSwOperStatus
docsDevSwFilename
docsDevSwServer
Number of Download tries
snmpEngineBoots

=
=
=
=
=
=
=
=
=

SB5102
2 (allowProvisioningUpgrade)
5 (other)
(unknown)
0.0.0.0
0
550

EVENT LOG NO LONGER STORED HERE! See NonVol/EventLog.


+--------------------------------------------------+
| DOCSIS CM Downstream Calibration NonVol Settings |

+--------------------------------------------------+
Magic Number = 0x446e5374 'DnSt'
Version (Permanent) = 2.0
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
DOCSIS CM Downtream Calibration Permanent NonVol Settings:
Number of Frequencies
Number of Tuner Coeffs
Number of IF Coeffs
Number of Fine Coeffs
Number of Equalizer Coeffs
Number of LDAIx Reads
Time between reads
Master Power Offset
Tuner Step Size

=
=
=
=
=
=
=
=
=

14
1
2
1
1
1
50 ms
84.2 dBmV
1 dBmV

Cal Table Values:


RowIndex=0; Freq=93000000 Hz; OffsetPower=1.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=1; Freq=153000000 Hz; OffsetPower=1.4 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=2; Freq=213000000 Hz; OffsetPower=1.6 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=3; Freq=273000000 Hz; OffsetPower=1.3 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=4; Freq=333000000 Hz; OffsetPower=1.5 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=5; Freq=393000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=6; Freq=453000000 Hz; OffsetPower=-0.3 dBmV

Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=7; Freq=513000000 Hz; OffsetPower=-0.4 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=8; Freq=573000000 Hz; OffsetPower=1.2 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=9; Freq=633000000 Hz; OffsetPower=1.4 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=10; Freq=693000000 Hz; OffsetPower=1.3 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=11; Freq=753000000 Hz; OffsetPower=-0.6 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=12; Freq=813000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=13; Freq=855000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
+------------------------------------------------+
| DOCSIS CM Upstream Calibration NonVol Settings |
+------------------------------------------------+
Magic Number = 0x55705374 'UpSt'
Version (Permanent) = 0.1
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
DOCSIS CM Uptream Calibration Permanent NonVol Settings:

Board Rev = 18 (Unknown/Don't Care)


Upstream Amp Type = 9 (BCM INTERNAL AMP)
Control Table Settings:
Start Power = 3.0 dBmV
End Power = 64.0 dBmV
Resolution = 0.25 dBmV
Values = {skipped for brevity; they can be printed manually}
Offset Table Settings:
Start Frequency =
End Frequency =
Resolution =
Values =

5.0 MHz
65.0 MHz
1.0 MHz
{skipped for brevity; they can be printed manually}

+----------------------------+
| CM Propane NonVol Settings |
+----------------------------+
Magic Number = 0x5070616e 'Ppan'
Version (Permanent) = 0.1
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Propane Cable Modem Permanent NonVol Settings:
Propane Enabled = 1
Propane Timer P1 Enabled = 1
Propane Timer P2 Enabled = 1
+--------------------------------------+
| CM Vendor (Motorola) NonVol Settings |
+--------------------------------------+
Magic Number = 0x4d4f544f 'MOTO'
Version (Permanent) = 0.6
Version (Dynamic) = 0.13
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
NOTE: 'Shadowed' settings are stored in a different NonVol group. Modifying
these settings actually modifies that group; access to these items is
provided here for convenience.
Motorola Permanent NonVol Settings:
cmFactoryResidentialGatewayEnable
cmFreqPlanType
cmDhcpServerEnable
cmCfgConcatEnabled
cmDocsis20Capable
cmAnnexMode
cmBabbleControl
cmDhcpServerEnable
cmQam256PowerFactorTableVersion
cmQam256PowerFactorArray

=
=
=
=
=
=
=
=
=
=

0
1
1
1
1
1
0
1
0

(shadowed from DOCSIS nonvol)


(shadowed from DOCSIS nonvol)
(shadowed from HAL IF nonvol)
(0)

00 00 00 00
00 00 00 00

00 00 00 00
00 00 00 00

00 00 00 00
00 00 00 00

00 00 00 00 | ................
00 00 00
| ...............

cmFactoryCalibrationFrequencyData = {suppressed for brevity}


cmFactoryDbgBootEnable = 0 (shadowed from BfcApp, Auto Conso
le)
cmFactoryEnetMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)
cmFactoryHfcMacAddr = 00:11:e3:aa:eb:08 (shadowed from Ha
lIf, IP1 MAC Addr)
cmFactorySetReset
cmFactorySerialNumber
SNMP, docsDevSerialNumber)
cmFactoryCliFlag
cmFactoryDisableMib
{inverted})
cmFactoryUpstreamPowerCalibration1
cmFactoryDownstreamCalibrationTableMaxSum
cmFactoryDownstreamCalibrationTableMinSum
cmFactoryBigRSAPublicKey
from BPI, BPI Public Key)
cmFactoryBigRSAPrivateKey
from BPI, BPI Private Key)
cmFactoryCMCertificate
from BPI, BPI+ CM Certificate)
cmFactoryManCertificate
from BPI, BPI+ CA Certificate)
cmFactoryRootPublicKey
from BPI, BPI+ Root Public Key)
cmFactoryCMManufacturerName
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

= 0
= '00968 - 142404658' (shadowed from
= 1
= 1 (shadowed from SNMP, AllowConfig
=
=
=
=

0xffffffef (4294967279)
0 (0)
0 (0)
{suppressed for brevity} (shadowed

= {suppressed for brevity} (shadowed


= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
=
00 00 00 00 | ................
| ........

cmFactoryHtmlReadOnly = 0
cmFactoryCmUsbMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)
cmFactoryCpeUsbMacAddr = 00:11:e3:aa:eb:02 (shadowed from Ha
lIf, USB MAC Addr)
cmFactoryCmAuxMacAddr = 00:20:40:de:ad:03 (shadowed from Ha
lIf, IP3 MAC Addr)

00
00
00
00
00
00
00
00
00

cmFactoryTunerId
cmFactoryHwRevision
cmFactoryUsAmpId
cmFactoryTop
cmFactoryDownstreamCalibrationOffset
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00

cmFactoryGwAppPublicKey
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00

=
00 00 00
00 00 00
00 00 00

=
=
=
=
=

4
0x1 (1)
4
0
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
............

00 00 00 00 | ................
00 00 00 00 | ................
00 00 00 00 | ................

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
....

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppPrivateKey
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
..

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppRootPublicKey
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00
00

00
00
00
00
00
00

00
00
00
00
00
00

00
00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

|
|
|
|
|
|

................
................
................
................
................
....

cmFactoryFWFeatureID = 0
Motorola Dynamic NonVol Settings:
cmFreqPlanType = 1
cmDhcpServerEnable = 1
cmCfgConcatEnabled = 1
cmDocsis20Capable = 1
cmAnnexMode = 3
cmBabbleControl = 0
cmConfigFreq1 = 666000000 Hz (shadowed from DOCSIS, DsFreq)
cmConfigFreq2 = 642000000 Hz
cmConfigFreq3 = 650000000 Hz
cmUpstreamChannelId1 = 3 (shadowed from DOCSIS, UsChan)
cmUpstreamChannelId2 = 16
cmUpstreamChannelId3 = 1
cmUpstreamPower1 = 53.50 dBmV (shadowed from DOCSIS, UsPower)
cmUpstreamPower2 = 54.0 dBmV
cmUpstreamPower3 = 54.0 dBmV
cmFactoryCodeSigningTime = (shadowed from BPI, Code Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactoryCVCValidityStartTime = (shadowed from BPI, CVC Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactorySwServer = 0.0.0.0 (shadowed from SNMP, docsDevSwServer)
cmFactorySwFilename = (unknown) (shadowed from SNMP, docsDevSwFilen
ame)
cmStandbyMode = 0
cmStandbyCapable = 0
cmSunboxCapable = 0
cmDhcpUnicastTrafficOnly = 0
cmConfigGuiHfcAccessEnable = 0
cmConfigEnableAllEventLogPriorities = 0
cmConfigT3TimeoutInitRngRetries = 
fCmFreqCustomListEntries = 0
fCmDocsis1xHackFor20CmtsEnable = 0
fDocsDevSTPControl = 
fCmClearUpstreamFavChanID = 0
+--------------------------------------+
| VendorSecureFactoryMibNonVolSettings |
+--------------------------------------+
Magic Number = 0x464d6962 'FMib'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Vendor NonVol Settings:

FmibTimerCounter = 0
FmibUserLevel = 0
CM/NonVol> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data flush
manufactured
read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> cd docsis
Active Command Table: CM DOCSIS NonVol Commands (docsis)
CM -> non-vol -> docsis
CM/NonVol/CM DOCSIS NonVol> dir
!
?
REM
cd
find_command
help
history
instances
man
pwd
sleep
syntax
usage
---bpi_version
clear_device
concat_thresh defaults
dhcp_settings doc10_mcastpromisc
ds_frequency
fake_reg
{flush}
ip_stack_number manufactured
queues
rate_shaping_time
read
rng_class_extension
show
startup_context
startup_uschan stats
tftp_read
tftp_timeout
timer_disable ugs_depth
ugs_table_entries
us_power
write
----

dir
ls
system_time
del_extra_data
enable
max_concat
rng_class
startup_dsfreq
tftp_write
us_channel

CM/NonVol/CM DOCSIS NonVol> enable


ERROR - required parameter ( canned|scan|bpi|concat|rate|frag|phs|igmp|docsis11|
dhcp|tod|tftp|rng|advphy|bpi23|20hack|opt_init_rng|force_cfgfile|AckCel|nonstd_u
s) was not specified!
COMMAND: enable
USAGE: enable canned|scan|bpi|concat|rate|frag|phs|igmp|docsis11|dhcp|tod|tftp
|rng|advphy|bpi23|20hack|opt_init_rng|force_cfgfile|AckCel|nonstd_us true|false
DESCRIPTION:
Enables or disables the specified feature. Most of these only take effect
the next time the CM 'resets the MAC' and registers with the CMTS. The
feature parameter is one of the following:
scan
bpi
concat

-- Scan single DsChan only


-- Baseline Privacy
-- Concatenation

frag
phs
igmp
rate
docsis11
dhcp
tod
tftp
canned
rng
advphy
bpi23
20hack
opt_init_rng
force_cfgfile
AckCel
nonstd_us

-----------------

Fragmentation
Payload Header Suppression
IGMP Multicast
Rate Shaping
DOCSIS 1.1 support
DHCP on CM's IP stack
Time Of Day
TFTP of CM config file
REG-REQ with canned config file
One-line RNG-RSP messages
Advanced PHY
Secure s/w dload in DOCSIS 1.1 mode
Hack to allow 2.0 CM register on 1.x CMTS
Turns optimized initial ranging (bisection) on or off.
Force a specified config file if using DHCP.
Enables or disables Broadcom's Patent Pending AckCel
Technology for the DOCSIS upsteam.
-- Configures s/w support for non-standard upstream
configurations (if supported by h/w).

EXAMPLES:
enable docsis11 true -- Enables DOCSIS 1.1 features.
enable rng 0
-- Disables one-line RNG-RSP messages.
CM/NonVol/CM DOCSIS NonVol> enable 20hack
ERROR - required parameter ( true|false) was not specified!
COMMAND: enable
USAGE: enable canned|scan|bpi|concat|rate|frag|phs|igmp|docsis11|dhcp|tod|tftp
|rng|advphy|bpi23|20hack|opt_init_rng|force_cfgfile|AckCel|nonstd_us true|false
DESCRIPTION:
Enables or disables the specified feature. Most of these only take effect
the next time the CM 'resets the MAC' and registers with the CMTS. The
feature parameter is one of the following:
scan
bpi
concat
frag
phs
igmp
rate
docsis11
dhcp
tod
tftp
canned
rng
advphy
bpi23
20hack
opt_init_rng
force_cfgfile
AckCel
nonstd_us

--------------------

Scan single DsChan only


Baseline Privacy
Concatenation
Fragmentation
Payload Header Suppression
IGMP Multicast
Rate Shaping
DOCSIS 1.1 support
DHCP on CM's IP stack
Time Of Day
TFTP of CM config file
REG-REQ with canned config file
One-line RNG-RSP messages
Advanced PHY
Secure s/w dload in DOCSIS 1.1 mode
Hack to allow 2.0 CM register on 1.x CMTS
Turns optimized initial ranging (bisection) on or off.
Force a specified config file if using DHCP.
Enables or disables Broadcom's Patent Pending AckCel
Technology for the DOCSIS upsteam.
-- Configures s/w support for non-standard upstream

configurations (if supported by h/w).


EXAMPLES:
enable docsis11 true -- Enables DOCSIS 1.1 features.
enable rng 0
-- Disables one-line RNG-RSP messages.
CM/NonVol/CM DOCSIS NonVol> enable
enable 20hack true
0x00152124 [ConsoleThread] BcmCmDocsisNonVolSettings::Docsis20HackFor1xCmtsEnabl
e: (CM DOCSIS NonVol Settings) WARNING DOCSIS 2.0 Hack enable/disable is compiled in now; can't set it!
Enabling 2.0 Hack for 1.x CMTS.
NOTE: This change will take effect the next time the modem registers with a CMT
S!
CM/NonVol/CM DOCSIS NonVol> enable force_cfgfile true
Enabling Force Config File.
NOTE: This change will take effect the next time the modem registers with a CMT
S!
CM/NonVol/CM DOCSIS NonVol>
***
*** VERBINDUNGSABBRUCH
*** Uhrzeit 17:29:11
***
***
*** VERBINDUNG: 192.168.200.1:23
*** Datum 09.04.2014
*** Uhrzeit 23:26:38
***
Haxorware integrated telnet daemon
Username: root
Password: ************
Welcome.
CM>
CM> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]

CM> cd cm_hal
Active Command Table: CM DOCSIS HAL Commands (cm_hal)
CM -> cm_hal
CM/CmHal> dir
!
find_command
man
usage
---ackcel_show
cpe_add
hal_show
mac_diag
qosParms
set_mode
tune_band
us_debug
write_posted
----

?
help
pwd

REM
history
sleep

bcmalloc_show bist_test
cpe_del
cpe_max
l2vpn_mask
ldaix_read
map_lead_time_show
read_mbr
read_posted
show
show_halif
tuner_read
tuner_write
us_reset
us_sweep

cd
instances
syntax

dir
ls
system_time

change
cpe_print
lock_ds
packets_queued
scan_ds
transmit
us_burst
us_transmit

counters
ds_state
log
qam_lock
scan_stop
tune
us_cw_transmit
write_mbr

CM/CmHal> set_mode
ERROR - required parameter ( OID) was not specified!
COMMAND: set_mode
USAGE: set_mode OID true|false
DESCRIPTION:
Calls the CM HAL SetMode entrypoint with the specified BFC_HAL_MODE OID and
the specified true/false value. The mode OID values come from BfcHal.h or
CblmodemHal.h.
EXAMPLES:
set_mode 0x50 true -- Turns the READY LED on
CM/CmHal> show
There are no Class of Service objects to show!
===========================================================
List of all Upstream Classifier objects:
1)
2)
3)
4)
5)
6)
7)
8)
9)

Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:

Id=0x9
Id=0x7
Id=0x5
Id=0x3
Id=0x2
Id=0x4
Id=0x6
Id=0x8
Id=0x1

SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4
SFID=0x28d4

===========================================================
List of all Downstream Classifier objects:

10)
11)
12)
13)
14)
15)
16)

Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:
Classifier:

Id=0x10 SFID=0x293a
Id=0xe SFID=0x293a
Id=0xc SFID=0x293a
Id=0xa SFID=0x293a
Id=0xb SFID=0x293a
Id=0xd SFID=0x293a
Id=0xf SFID=0x293a

There are no PHS Rules to show!


===========================================================
List of all Upstream Service Flow objects:
1) ServiceFlow: SFID=0x1d80 Upstream SID=0x11f0, BE
2) ServiceFlow: SFID=0x28d4 Upstream SID=0xebf, BE
===========================================================
List of all Downstream Service Flow objects:
3) ServiceFlow: SFID=0x2829 Downstream
4) ServiceFlow: SFID=0x293a Downstream
CM/CmHal> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> dir
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]
CM> cd non-vol
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> ls
!
find_command
man
usage
---clear_device

?
help
pwd

REM
history
sleep

cd
instances
syntax

defaults

del_extra_data flush

dir
ls
system_time
manufactured

read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> cd docsis
Active Command Table: CM DOCSIS NonVol Commands (docsis)
CM -> non-vol -> docsis
CM/NonVol/CM DOCSIS NonVol> dir
!
?
REM
cd
find_command
help
history
instances
man
pwd
sleep
syntax
usage
---bpi_version
clear_device
concat_thresh defaults
dhcp_settings doc10_mcastpromisc
ds_frequency
fake_reg
{flush}
ip_stack_number manufactured
queues
rate_shaping_time
read
rng_class_extension
show
startup_context
startup_uschan stats
tftp_read
tftp_timeout
timer_disable ugs_depth
ugs_table_entries
us_power
write
----

dir
ls
system_time
del_extra_data
enable
max_concat
rng_class
startup_dsfreq
tftp_write
us_channel

CM/NonVol/CM DOCSIS NonVol> enable


ERROR - required parameter ( canned|scan|bpi|concat|rate|frag|phs|igmp|docsis11|
dhcp|tod|tftp|rng|advphy|bpi23|20hack|opt_init_rng|force_cfgfile|AckCel|nonstd_u
s) was not specified!
COMMAND: enable
USAGE: enable canned|scan|bpi|concat|rate|frag|phs|igmp|docsis11|dhcp|tod|tftp
|rng|advphy|bpi23|20hack|opt_init_rng|force_cfgfile|AckCel|nonstd_us true|false
DESCRIPTION:
Enables or disables the specified feature. Most of these only take effect
the next time the CM 'resets the MAC' and registers with the CMTS. The
feature parameter is one of the following:
scan
bpi
concat
frag
phs
igmp
rate
docsis11
dhcp
tod
tftp
canned
rng
advphy
bpi23

----------------

Scan single DsChan only


Baseline Privacy
Concatenation
Fragmentation
Payload Header Suppression
IGMP Multicast
Rate Shaping
DOCSIS 1.1 support
DHCP on CM's IP stack
Time Of Day
TFTP of CM config file
REG-REQ with canned config file
One-line RNG-RSP messages
Advanced PHY
Secure s/w dload in DOCSIS 1.1 mode

20hack
opt_init_rng
force_cfgfile
AckCel
nonstd_us

-----

Hack to allow 2.0 CM register on 1.x CMTS


Turns optimized initial ranging (bisection) on or off.
Force a specified config file if using DHCP.
Enables or disables Broadcom's Patent Pending AckCel
Technology for the DOCSIS upsteam.
-- Configures s/w support for non-standard upstream
configurations (if supported by h/w).

EXAMPLES:
enable docsis11 true -- Enables DOCSIS 1.1 features.
enable rng 0
-- Disables one-line RNG-RSP messages.
CM/NonVol/CM DOCSIS NonVol> cd ..
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> dir
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data flush
manufactured
read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> cd snmp_cm
Active Command Table: CM SNMP NonVol Commands (snmp_cm)
CM -> non-vol -> snmp_cm
CM/NonVol/CM SNMP NonVol> dir
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---allow_config
clear_device
defaults
del_extra_data
diag_disable_post_reg
dload_tries
docsDevSerialNumber
docsDevSwAdminStatus
docsDevSwCurrentVers
docsDevSwFilename
docsDevSwOperStatus
docsDevSwServer
{flush}
hide_ipstack_ifentries
ip_def_ignore llc_unm_ignore
manufactured
max_dload_tries read
show
single_ip_filt
stats
sysContact
sysDescr
sysLocation
sysName
sysORDescr
sysORID
sysObjectId
sysServices
tftp_read
tftp_write
vendor_name
write
---CM/NonVol/CM SNMP NonVol> docsdevswfilename
Error - Unknown command: 'docsdevswfilename'

CM/NonVol/CM SNMP NonVol> help


!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---allow_config
clear_device
defaults
del_extra_data
diag_disable_post_reg
dload_tries
docsDevSerialNumber
docsDevSwAdminStatus
docsDevSwCurrentVers
docsDevSwFilename
docsDevSwOperStatus
docsDevSwServer
{flush}
hide_ipstack_ifentries
ip_def_ignore llc_unm_ignore
manufactured
max_dload_tries read
show
single_ip_filt
stats
sysContact
sysDescr
sysLocation
sysName
sysORDescr
sysORID
sysObjectId
sysServices
tftp_read
tftp_write
vendor_name
write
---CM/NonVol/CM SNMP NonVol> show
+-------------------------+
| CM SNMP NonVol Settings |
+-------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x736e6d70 'snmp'
0.4
0.6
0
0
1
1

CM SNMP Permanent NonVol Settings:


AllowConfiguration =
Vendor Name =
sysDescr =
SW_REV: 1.1; MODEL: THG571>>
sysObjectID =
sysORID.1 =
sysORDescr.1 =
ment
sysServices =
docsDevSwCurrentVers =
docsDevSerialNumber =
Max Download Tries =
Disable diag agent post-reg =
Hide IP stack ifEntries =

0
Thomson THG571
<<HW_REV: 1; VENDOR: Thomson THG571; BOOTR: 2164;
1.3.6.1.4.1.1166.0.1.0.0.0.0.0
1.3.6.1.4.1.1166.1.20
Motorola Cable Modem SNMP Agent Capabilities State
0x4f
1.1
00968 - 142404658
4
0
1

CM SNMP Dynamic NonVol Settings:


sysContact
sysName
sysLocation
docsDevSwAdminStatus
docsDevSwOperStatus
docsDevSwFilename
docsDevSwServer
Number of Download tries

=
=
=
=
=
=
=
=

SB5102
2 (allowProvisioningUpgrade)
5 (other)
(unknown)
0.0.0.0
0

snmpEngineBoots = 552
EVENT LOG NO LONGER STORED HERE! See NonVol/EventLog.
CM/NonVol/CM SNMP NonVol> cd ..
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> dir
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data flush
manufactured
read
show
stats
tftp_read
tftp_write
write
---[Motorola] [bfcApp] [bpi] [docsis] [ds-cal] [event_log] [factory] [halif]
[propane] [snmp_cm] [us-cal] [userif]
CM/NonVol> cd userif
Active Command Table: User Interface NonVol Commands (userif)
CM -> non-vol -> userif
CM/NonVol/User Interface NonVol> dir
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---clear_device
defaults
del_extra_data dhcp_settings fields
{flush}
http_acl_host_add
http_acl_host_remove
http_acl_hosts_clear
http_admin
http_adv_ipstacks
http_enable
http_ipstacks http_password_idle_timeout
http_password_seed
http_socket_show
http_user
inactivity_timeout
ip_stack_number manufactured
password
read
severities
show
ssh_enable
ssh_ipstacks
stats
telnet_enable telnet_ipstacks tftp_read
tftp_write
user_name
write
---CM/NonVol/User Interface NonVol> show
+--------------------------------+
| User Interface NonVol Settings |
+--------------------------------+
Magic Number = 0x4d4c6f67 'MLog'
Version (Permanent) = 0.2
Version (Dynamic) = 0.4
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1

Is Manufactured (Dynamic) = 1
User Interface Dynamic NonVol Settings:
HTTP User ID = ''
HTTP User Password = 'Motorola'
HTTP Admin ID = '(DISABLED)'
HTTP Admin Password = '(DISABLED)'
Remote Access User Name = ''
Remote Access Password = ''
Remote Access inactivity timeout = '0'
Telnet Access Enabled = 0
Telnet IP Stack enable = 0x3 (IP2|IP1)
SSH Access Enabled = 0
SSH IP Stack enable = 0x3 (IP2|IP1)
HTTP Access Enabled = 0
HTTP IP stack enable = 0x2 (IP2)
HTTP Advanced IP stack enable = 0 ({None})
HTTP Password Seed = ''
HTTP Remote IP ACL (emtpy == allow all)::
HTTP Password Idle Timeout = 0
User Interface Permanent NonVol Settings:
Default Severities = 0x7 (Warnings | Errors | Fatal Errors)
Default Fields = 0x3f (Thread Id | Timestamps | Module/Class N
ame | Function/Method Name | Instance Name | Severity)
Remote Access IP address = 192.168.200.1
Remote Access Subnet Mask = 255.255.255.0
Remote Access Router address = 192.168.200.254
Remote Access IP Stack Number = 2
CM/NonVol/User Interface NonVol> cd ..
Active Command Table: Non-Volatile Settings Commands (non-vol)
CM -> non-vol
CM/NonVol> show
+---------------------------------+
| BFC Application NonVol Settings |
+---------------------------------+
Magic Number = 0x434d4170 'CMAp'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
CM Application Permanent NonVol Settings:
Automatically stop at console = 0
'Skip driver init' Prompt Enabled = 0
'Stop at console' Prompt Enabled = 0
CM Application Dynamic NonVol Settings:

Serial console mode = readWrite


+--------------------------------+
| User Interface NonVol Settings |
+--------------------------------+
Magic Number = 0x4d4c6f67 'MLog'
Version (Permanent) = 0.2
Version (Dynamic) = 0.4
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
User Interface Dynamic NonVol Settings:
HTTP User ID = ''
HTTP User Password = 'Motorola'
HTTP Admin ID = '(DISABLED)'
HTTP Admin Password = '(DISABLED)'
Remote Access User Name = ''
Remote Access Password = ''
Remote Access inactivity timeout = '0'
Telnet Access Enabled = 0
Telnet IP Stack enable = 0x3 (IP2|IP1)
SSH Access Enabled = 0
SSH IP Stack enable = 0x3 (IP2|IP1)
HTTP Access Enabled = 0
HTTP IP stack enable = 0x2 (IP2)
HTTP Advanced IP stack enable = 0 ({None})
HTTP Password Seed = ''
HTTP Remote IP ACL (emtpy == allow all)::
HTTP Password Idle Timeout = 0
User Interface Permanent NonVol Settings:
Default Severities = 0x7 (Warnings | Errors | Fatal Errors)
Default Fields = 0x3f (Thread Id | Timestamps | Module/Class N
ame | Function/Method Name | Instance Name | Severity)
Remote Access IP address = 192.168.200.1
Remote Access Subnet Mask = 255.255.255.0
Remote Access Router address = 192.168.200.254
Remote Access IP Stack Number = 2
+-----------------------+
| HalIf NonVol Settings |
User Interface Permanent NonVol Settings:
Default Severities = 0x7 (Warnings | Errors | Fatal Errors)
Default Fields = 0x3f (Thread Id | Timestamps | Module/Class N
ame | Function/Method Name | Instance Name | Severity)
Remote Access IP address = 192.168.200.1
Remote Access Subnet Mask = 255.255.255.0
Remote Access Router address = 192.168.200.254
Remote Access IP Stack Number = 2
+-----------------------+
| HalIf NonVol Settings |

+-----------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0xf2a1f61f '....'
0.17
0.0
0
0
1
1

HAL Interface Permanent NonVol Settings:


Enabled Interfaces = 0x3b (IP2 IP1 USB Ethernet DocsisCm)
MAC
MAC
MAC
MAC
MAC
MAC
MAC
MAC

address
address
address
address
address
address
address
address

for
for
for
for
for
for
for
for

IP
IP
IP
IP
IP
IP
IP
IP

Stack
Stack
Stack
Stack
Stack
Stack
Stack
Stack

1
2
3
4
5
6
7
8

=
=
=
=
=
=
=
=

00:11:e3:aa:eb:08
00:11:e3:aa:eb:01
00:20:40:de:ad:03
00:20:40:de:ad:04
00:20:40:de:ad:05
00:20:40:de:ad:06
00:20:40:de:ad:07
00:20:40:de:ad:08

Default HAL Debug Zones = 0 ({None})


Board Rev = 18 (BCM93345)
USB HAL Settings:
---------------USB Vendor Id =
USB Device Id =
USB MAC address =
USB Rndis Driver Enabled

0x7b2
0x5101
00:11:e3:aa:eb:02
= 0

Bluetooth HAL Settings:


----------------------Local Mac Address = 00:20:40:de:ad:0a
Remote Mac Address = 00:20:40:de:ad:0b
Master Enabled = 0
Ethernet HAL Settings:
--------------------Autonegotiate Enabled
Default Link Speed
Default Link Full Duplex
Reject CAM Enabled

=
=
=
=

1
10 Mbps
0
1

HPNA HAL Settings:


----------------Default Message Level = 1
CM HAL Settings:
--------------Downstream Tuner Type
Upstream Amp Type
Downstream Reference Frequency
Upstream Reference Frequency
Input Frequency to PHY
Annex Mode
Spreader Scale
Upstream Sample Frequency

=
=
=
=
=
=
=
=

19 (BCM3419)
9 (BCM INTERNAL AMP)
30000000 hz
24000000 hz
5000000 hz
ANNEX A
1
480000000 hz

1024QAM Enabled = 1
Use DOCSIS 2.0 Clipping = 1
Proprietary SCDMA Code Matrix Enabled = 0
Advance Map RunAhead Enabled = 1
Upstream Priority Queue Support Enable = 1
DS_AGI = 0xd
DS_AGT = 0x1d
STATHR = 0x400
STAGI = 0
STPGA1 = 0x20042
STAGT = 0xfff00000
STABW1 = 0xd0b
STABW2 = 0x409
Number of SHACK Tries = 3
Power save mode enabled = 0
Optimized 3420 frequency map enabled = 1
High output PA enabled = 0
Board HAL Settings:
-----------------Watchdog Enabled = 1
Watchdog Timeout = 15 secs

0:
1:
2:
3:
4:
5:

BcmAlloc Settings:
----------------Buffer Size ( 16)
Buffer Size ( 48)
Buffer Size ( 160)
Buffer Size ( 288)
Buffer Size (1536)
Buffer Size (1648)
-----------------Total (approx) RAM

=
=
=
=
=
=

32 buffers
32 buffers
64 buffers
200 buffers
4 buffers
400 buffers
-----------= 718 kbytes

+-------------------------+
| Factory NonVol Settings |
+-------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x46414354 'FACT'
0.2
0.1
0
0
1
1

Broadcom Factory Extension Permanent NonVol Settings:


Private MIB enable: 0
Temporary MIB enable key allowed: 1
Enable Key 0:
Enable Key 1:
Enable Key 2:
Enable Key 3:
Enable Key 4:
Enable Key 5:
Enable Key 6:
Enable Key 7:
Serial Number 0:
Serial Number 1:
Serial Number 2:

Serial Number 3:
Broadcom Factory Extension Dynamic NonVol Settings:
Scratch Pad: 0
+------------------------+
| CM BPI NonVol Settings |
+------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x62706920 'bpi '


0.1
0.2
0
0
1
1

BPI Permanent NonVol Settings: (Values suppressed for brevity)


BPI Public Key
BPI Private Key
BPI+ Root Public Key
BPI+ CM Certificate
BPI+ CA Certificate

=
=
=
=
=

(963 bytes)
(636 bytes)
(914 bytes)
(1422 bytes)
(992 bytes)

BPI Dynamic NonVol Settings:


Secure Software Download settings:
Code Access Start =
30 30 30 31 30 31 30 30

30 30 30 30 | 000101000000

CVC Access Start =


30 30 30 31 30 31 30 30

30 30 30 30 | 000101000000

Co-Signing Agent Name = ''


Upgraded BPI+ Key settings: (Values suppressed for brevity)
Root Public Key upgraded
CA Certificate upgraded
Upgraded Root Public Key
Upgraded CA Certificate

=
=
=
=

+---------------------------+
| CM DOCSIS NonVol Settings |
+---------------------------+
Magic Number =
Version (Permanent) =
Version (Dynamic) =
Is Default (Permanent) =
Is Default (Dynamic) =
Is Manufactured (Permanent) =
Is Manufactured (Dynamic) =

0
0
(0 bytes)
(0 bytes)

0xd0c20100 '....'
0.4
0.4
0
0
1
1

DOCSIS Cable Modem Permanent NonVol Settings:


Scan Single DsChan Enabled = 0
BPI Enabled = 0
Concatenation Enabled = 1

Fragmentation Enabled = 1
PHS Enabled = 1
IGMP Enabled = 1
Rate Shaping Enabled = 1
DOCSIS 1.1 Features Enabled = 1
DHCP Enabled = 1
Time Of Day Enabled = 1
Config File TFTP Enabled = 1
Canned Registration Enabled = 0
One-line RNG-RSP Enabled = 0
Advanced PHY Enabled = 1
DOCSIS 2.0 Hack for 1.x CMTS = 0
BPI23 (secure s/w dload) Enabled = 0
Optimized Initial Ranging Enabled = 1
Force Config File Enabled = 0
AckCel technology Enabled = 1
NonStandard Upstream Enabled = 0
Upstream Queues Enabled = 0 (all queues can be used)
BPI Version = 0
Disabled DOCSIS Timers = 0xf (T4 T3 T2 T1)
Concatenation Threshold = 2 packets
Rate Shaping Time Interval = 2 seconds
TFTP Retry Timeout = 20 seconds
IP Stack Number = 1
Max UGS Queue Depth = 3 packets {deprecated}
Max Concat Packets = 128 packets
Ranging Class = 0x1

0
1
2
3

Max UGS Queue Depth Settings:


---------------------------0..150
uSec : 32 packets
151..250
uSec : 8 packets
251..500
uSec : 4 packets
501..65535 uSec : 3 packets

If DHCP is not enabled, then the following settings will be used:


DHCP Settings:
My offered IP address
Subnet Mask
Router IP address
TFTP Server IP address
CM Configuration file
Time Server IP address
Log Server IP address

=
=
=
=
=
=
=

10.10.10.10
255.255.255.0
10.10.10.254
10.175.0.1
'kfoA,.iyewrkldJKDHSUBsgv'
10.175.0.1
10.10.10.254

DOCSIS Cable Modem Dynamic NonVol Settings:


Downstream Frequency = 666000000 hz
Upstream Channel = 3
Upstream Power = 214 quarter dBmV (53.50 dBmV)
Docsis10IgmpSupportEnabled = 1
Docsis10IgmpMulticastPromiscEnabled = 1
Startup Target DsFreq = 0 hz
Startup Target UsChannel = 0
Startup Target Context = 0
Ranging Class Extension = 0
+-------------------------------------+

| CableModem EventLog NonVol Settings |


+-------------------------------------+
Magic Number = 0x434d4556 'CMEV'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Permanent Settings:
(there are no permanent event log settings)
Dynamic Settings:
Capacity = 100 events
Next available = -1
Event#
Id
Count FirstTime LastTime
------ -------------- ----- --------- -------0
68000100
5
20
144
1
82000400
1
204
204
2
2300955924
1
204
204
3
2300955728
1
2
2
4
2300955725
1
5
5
5
68000100
17
19
544
6
82000400
1
604
604
7
2300955924
1
604
604
8
2300955725
1
2
2
9
68000100
17
18
548
10
82000400
1
607
607
11
2300955924
1
607
607
12
2300955728
1
2
2
13
2300955725
1
5
5
14
68000300
1
21
21
15
73040100
4 1396972624 1396972624
16
2300955824
1 1396972624 1396972624
17
68000300
1 1396972638 1396972638
18
73040100
4 1396972644 1396972644
19
2436694044
1 1397052773 1397052773
20
2300955924
1 1397052773 1397052773
21
2300955725
1
6
6
22
68000300
1
19
19
23
2436694044
1 1397053016 1397053016
24
2300955924
1 1397053016 1397053016
25
2300955725
1
6
6
26
68000300
1
19
19
27
2436694044
1 1397053179 1397053179
28
2300955924
1 1397053179 1397053179
29
2300955725
1
5
6
30
68000300
1
18
18
31
68010300
1 1397055006 1397055006
32
2436694044
1 1397055497 1397055497
33
2300955924
1 1397055497 1397055497
34
2300955725
1
5
6
35
68000300
1
18
18
36
2436694044
1 1397056897 1397056897
37
2300955924
1 1397056897 1397056897
38
2300955725
1
6
6
39
68000300
1
19
19

40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

68000500
2436694044
2300955924
2300955725
68000300
68000500
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2436694044
2300955924
2300955725
68000300
73000100
2300955824
68000300
73000100
2300955824
82000200
82000200
68000300
73000100
2436694044
2300955924
2300955725
82000400
2300955924
2300955725
82000200
82000300
2436694044
2300955924
82000200
2436694044
2300955924
2300955725
68000300
82000500
2436694044
2300955924
2300955725
68000300
2436694044
2300955924
2300955725
68000300
82000500
68010300

1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
2
2
2
1
1
1
1
1
1
1
17
1
1
1
9
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

1397057025
1397057052
1397057052
5
21
1397057183
1397057190
1397057190
6
19
1397057224
1397057280
1397057280
6
17
1397057316
1397058043
1397058043
6
17
1397058078
1397058248
1397058248
6
19
1397058285
1397058285
1397058298
1397058307
1397058307
1397058312
1397058330
1397058349
1397058704
1397059081
1397059081
5
43
43
6
12
117
144
144
10
60
60
6
18
1397060234
1397060964
1397060964
6
19
1397062111
1397062111
6
18
1397062590
1397063937

1397057025
1397057052
1397057052
6
21
1397057183
1397057190
1397057190
6
19
1397057224
1397057280
1397057280
6
17
1397057316
1397058043
1397058043
6
17
1397058078
1397058248
1397058248
6
19
1397058285
1397058285
1397058298
1397058307
1397058307
1397058314
1397058333
18
1397058704
1397059081
1397059081
6
43
43
6
117
117
144
144
58
60
60
6
18
1397060234
1397060964
1397060964
6
19
1397062111
1397062111
6
18
1397062590
1397063937

Event Text:
0: DHCP FAILED - Discover sent, no offer received
1: Received Response to Broadcast Maintenance Request, But no Unicast Maintenanc
e opportunities received - T4 timeout
2: Modem Is Shutting Down and Rebooting...
3: Ethernet link dormant - not currently active
4: Ethernet link up - ready to pass packets
5: DHCP FAILED - Discover sent, no offer received
6: Received Response to Broadcast Maintenance Request, But no Unicast Maintenanc
e opportunities received - T4 timeout
7: Modem Is Shutting Down and Rebooting...
8: Ethernet link up - ready to pass packets
9: DHCP FAILED - Discover sent, no offer received
10: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
11: Modem Is Shutting Down and Rebooting...
12: Ethernet link dormant - not currently active
13: Ethernet link up - ready to pass packets
14: DHCP WARNING - Non-critical field invalid in response.
15: TLV-11 - unrecognized OID
16: Neg Or Bad Reg Rsp - Reinitialize MAC...
17: DHCP WARNING - Non-critical field invalid in response.
18: TLV-11 - unrecognized OID
19: Resetting the cable modem due to docsDevResetNow
20: Modem Is Shutting Down and Rebooting...
21: Ethernet link up - ready to pass packets
22: DHCP WARNING - Non-critical field invalid in response.
23: Resetting the cable modem due to docsDevResetNow
24: Modem Is Shutting Down and Rebooting...
25: Ethernet link up - ready to pass packets
26: DHCP WARNING - Non-critical field invalid in response.
27: Resetting the cable modem due to docsDevResetNow
28: Modem Is Shutting Down and Rebooting...
29: Ethernet link up - ready to pass packets
30: DHCP WARNING - Non-critical field invalid in response.
31: DHCP RENEW WARNING - Field invalid in response
32: Resetting the cable modem due to docsDevResetNow
33: Modem Is Shutting Down and Rebooting...
34: Ethernet link up - ready to pass packets
35: DHCP WARNING - Non-critical field invalid in response.
36: Resetting the cable modem due to docsDevResetNow
37: Modem Is Shutting Down and Rebooting...
38: Ethernet link up - ready to pass packets
39: DHCP WARNING - Non-critical field invalid in response.
40: TFTP failed - request sent - No Response
41: Resetting the cable modem due to docsDevResetNow
42: Modem Is Shutting Down and Rebooting...
43: Ethernet link up - ready to pass packets
44: DHCP WARNING - Non-critical field invalid in response.
45: TFTP failed - request sent - No Response
46: Resetting the cable modem due to docsDevResetNow
47: Modem Is Shutting Down and Rebooting...
48: Ethernet link up - ready to pass packets
49: DHCP WARNING - Non-critical field invalid in response.
50: REG-RSP - invalid format or not recognized
51: Resetting the cable modem due to docsDevResetNow
52: Modem Is Shutting Down and Rebooting...
53: Ethernet link up - ready to pass packets
54: DHCP WARNING - Non-critical field invalid in response.
55: REG-RSP - invalid format or not recognized

56: Resetting the cable modem due to docsDevResetNow


57: Modem Is Shutting Down and Rebooting...
58: Ethernet link up - ready to pass packets
59: DHCP WARNING - Non-critical field invalid in response.
60: REG-RSP - invalid format or not recognized
61: Resetting the cable modem due to docsDevResetNow
62: Modem Is Shutting Down and Rebooting...
63: Ethernet link up - ready to pass packets
64: DHCP WARNING - Non-critical field invalid in response.
65: REG-RSP - invalid format or not recognized
66: Neg Or Bad Reg Rsp - Reinitialize MAC...
67: DHCP WARNING - Non-critical field invalid in response.
68: REG-RSP - invalid format or not recognized
69: Neg Or Bad Reg Rsp - Reinitialize MAC...
70: No Ranging Response received - T3 time-out (US 4)
71: No Ranging Response received - T3 time-out (US 3)
72: DHCP WARNING - Non-critical field invalid in response.
73: REG-RSP - invalid format or not recognized
74: Resetting the cable modem due to docsDevResetNow
75: Modem Is Shutting Down and Rebooting...
76: Ethernet link up - ready to pass packets
77: Received Response to Broadcast Maintenance Request, But no Unicast Maintenan
ce opportunities received - T4 timeout
78: Modem Is Shutting Down and Rebooting...
79: Ethernet link up - ready to pass packets
80: No Ranging Response received - T3 time-out (US 3)
81: Init RANGING Critical Ranging Request (17) Retries exhausted
82: Resetting the cable modem due to docsDevResetNow
83: Modem Is Shutting Down and Rebooting...
84: No Ranging Response received - T3 time-out (US 3)
85: Resetting the cable modem due to docsDevResetNow
86: Modem Is Shutting Down and Rebooting...
87: Ethernet link up - ready to pass packets
88: DHCP WARNING - Non-critical field invalid in response.
89: Started Unicast Maintenance Ranging - No Response received - T3 time-out
90: Resetting the cable modem due to docsDevResetNow
91: Modem Is Shutting Down and Rebooting...
92: Ethernet link up - ready to pass packets
93: DHCP WARNING - Non-critical field invalid in response.
94: Resetting the cable modem due to docsDevResetNow
95: Modem Is Shutting Down and Rebooting...
96: Ethernet link up - ready to pass packets
97: DHCP WARNING - Non-critical field invalid in response.
98: Started Unicast Maintenance Ranging - No Response received - T3 time-out
99: DHCP RENEW WARNING - Field invalid in response
+-------------------------+
| CM SNMP NonVol Settings |
+-------------------------+
Magic Number
Version (Permanent)
Version (Dynamic)
Is Default (Permanent)
Is Default (Dynamic)
Is Manufactured (Permanent)
Is Manufactured (Dynamic)

=
=
=
=
=
=
=

0x736e6d70 'snmp'
0.4
0.6
0
0
1
1

CM SNMP Permanent NonVol Settings:


AllowConfiguration = 0

Vendor Name =
sysDescr =
SW_REV: 1.1; MODEL: THG571>>
sysObjectID =
sysORID.1 =
sysORDescr.1 =
ment
sysServices =
docsDevSwCurrentVers =
docsDevSerialNumber =
Max Download Tries =
Disable diag agent post-reg =
Hide IP stack ifEntries =

Thomson THG571
<<HW_REV: 1; VENDOR: Thomson THG571; BOOTR: 2164;
1.3.6.1.4.1.1166.0.1.0.0.0.0.0
1.3.6.1.4.1.1166.1.20
Motorola Cable Modem SNMP Agent Capabilities State
0x4f
1.1
00968 - 142404658
4
0
1

CM SNMP Dynamic NonVol Settings:


sysContact
sysName
sysLocation
docsDevSwAdminStatus
docsDevSwOperStatus
docsDevSwFilename
docsDevSwServer
Number of Download tries
snmpEngineBoots

=
=
=
=
=
=
=
=
=

SB5102
2 (allowProvisioningUpgrade)
5 (other)
(unknown)
0.0.0.0
0
552

EVENT LOG NO LONGER STORED HERE! See NonVol/EventLog.


+--------------------------------------------------+
| DOCSIS CM Downstream Calibration NonVol Settings |
+--------------------------------------------------+
Magic Number = 0x446e5374 'DnSt'
Version (Permanent) = 2.0
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
DOCSIS CM Downtream Calibration Permanent NonVol Settings:
Number of Frequencies
Number of Tuner Coeffs
Number of IF Coeffs
Number of Fine Coeffs
Number of Equalizer Coeffs
Number of LDAIx Reads
Time between reads
Master Power Offset
Tuner Step Size

=
=
=
=
=
=
=
=
=

14
1
2
1
1
1
50 ms
84.2 dBmV
1 dBmV

Cal Table Values:


RowIndex=0; Freq=93000000 Hz; OffsetPower=1.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=1; Freq=153000000 Hz; OffsetPower=1.4 dBmV

Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=2; Freq=213000000 Hz; OffsetPower=1.6 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=3; Freq=273000000 Hz; OffsetPower=1.3 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=4; Freq=333000000 Hz; OffsetPower=1.5 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=5; Freq=393000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=6; Freq=453000000 Hz; OffsetPower=-0.3 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=7; Freq=513000000 Hz; OffsetPower=-0.4 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=8; Freq=573000000 Hz; OffsetPower=1.2 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=9; Freq=633000000 Hz; OffsetPower=1.4 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=10; Freq=693000000 Hz; OffsetPower=1.3 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=11; Freq=753000000 Hz; OffsetPower=-0.6 dBmV

Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=12; Freq=813000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
RowIndex=13; Freq=855000000 Hz; OffsetPower=0.7 dBmV
Tuner Coeffs=0,
IF Coeffs=0, 1000,
Fine Coeffs=0,
Equalizer Coeffs=0,
+------------------------------------------------+
| DOCSIS CM Upstream Calibration NonVol Settings |
+------------------------------------------------+
Magic Number = 0x55705374 'UpSt'
Version (Permanent) = 0.1
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
DOCSIS CM Uptream Calibration Permanent NonVol Settings:
Board Rev = 18 (Unknown/Don't Care)
Upstream Amp Type = 9 (BCM INTERNAL AMP)
Control Table Settings:
Start Power = 3.0 dBmV
End Power = 64.0 dBmV
Resolution = 0.25 dBmV
Values = {skipped for brevity; they can be printed manually}
Offset Table Settings:
Start Frequency =
End Frequency =
Resolution =
Values =

5.0 MHz
65.0 MHz
1.0 MHz
{skipped for brevity; they can be printed manually}

+----------------------------+
| CM Propane NonVol Settings |
+----------------------------+
Magic Number = 0x5070616e 'Ppan'
Version (Permanent) = 0.1
Version (Dynamic) = 0.0
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Propane Cable Modem Permanent NonVol Settings:
Propane Enabled = 1

Propane Timer P1 Enabled = 1


Propane Timer P2 Enabled = 1
+--------------------------------------+
| CM Vendor (Motorola) NonVol Settings |
+--------------------------------------+
Magic Number = 0x4d4f544f 'MOTO'
Version (Permanent) = 0.6
Version (Dynamic) = 0.13
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Propane Cable Modem Permanent NonVol Settings:
Propane Enabled = 1
Propane Timer P1 Enabled = 1
Propane Timer P2 Enabled = 1
+--------------------------------------+
| CM Vendor (Motorola) NonVol Settings |
+--------------------------------------+
Magic Number = 0x4d4f544f 'MOTO'
Version (Permanent) = 0.6
Version (Dynamic) = 0.13
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
NOTE: 'Shadowed' settings are stored in a different NonVol group. Modifying
these settings actually modifies that group; access to these items is
provided here for convenience.
Motorola Permanent NonVol Settings:
cmFactoryResidentialGatewayEnable
cmFreqPlanType
cmDhcpServerEnable
cmCfgConcatEnabled
cmDocsis20Capable
cmAnnexMode
cmBabbleControl
cmDhcpServerEnable
cmQam256PowerFactorTableVersion
cmQam256PowerFactorArray
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

=
=
=
=
=
=
=
=
=
=

0
1
1
1
1
1
0
1
0

(shadowed from DOCSIS nonvol)


(shadowed from DOCSIS nonvol)
(shadowed from HAL IF nonvol)
(0)

00 00 00 00 | ................
00 00 00
| ...............

cmFactoryCalibrationFrequencyData = {suppressed for brevity}


cmFactoryDbgBootEnable = 0 (shadowed from BfcApp, Auto Conso
le)
cmFactoryEnetMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)
cmFactoryHfcMacAddr = 00:11:e3:aa:eb:08 (shadowed from Ha
lIf, IP1 MAC Addr)
cmFactorySetReset
cmFactorySerialNumber
SNMP, docsDevSerialNumber)
cmFactoryCliFlag
cmFactoryDisableMib

= 0
= '00968 - 142404658' (shadowed from
= 1
= 1 (shadowed from SNMP, AllowConfig

{inverted})
cmFactoryUpstreamPowerCalibration1
cmFactoryDownstreamCalibrationTableMaxSum
cmFactoryDownstreamCalibrationTableMinSum
cmFactoryBigRSAPublicKey
from BPI, BPI Public Key)
cmFactoryBigRSAPrivateKey
from BPI, BPI Private Key)
cmFactoryCMCertificate
from BPI, BPI+ CM Certificate)
cmFactoryManCertificate
from BPI, BPI+ CA Certificate)
cmFactoryRootPublicKey
from BPI, BPI+ Root Public Key)
cmFactoryCMManufacturerName
00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

=
=
=
=

0xffffffef (4294967279)
0 (0)
0 (0)
{suppressed for brevity} (shadowed

= {suppressed for brevity} (shadowed


= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
= {suppressed for brevity} (shadowed
=
00 00 00 00 | ................
| ........

cmFactoryHtmlReadOnly = 0
cmFactoryCmUsbMacAddr = 00:11:e3:aa:eb:01 (shadowed from Ha
lIf, IP2 MAC Addr)
cmFactoryCpeUsbMacAddr = 00:11:e3:aa:eb:02 (shadowed from Ha
lIf, USB MAC Addr)
cmFactoryCmAuxMacAddr = 00:20:40:de:ad:03 (shadowed from Ha
lIf, IP3 MAC Addr)

00
00
00
00
00
00
00
00
00

cmFactoryTunerId
cmFactoryHwRevision
cmFactoryUsAmpId
cmFactoryTop
cmFactoryDownstreamCalibrationOffset
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppPublicKey
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

=
=
=
=
=

4
0x1 (1)
4
0
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
............

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

|
|
|
|
|

................
................
................
................
....

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppPrivateKey
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
..

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

cmFactoryGwAppRootPublicKey
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00

=
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
................
....

cmFactoryFWFeatureID = 0
Motorola Dynamic NonVol Settings:
cmFreqPlanType
cmDhcpServerEnable
cmCfgConcatEnabled
cmDocsis20Capable
cmAnnexMode

=
=
=
=
=

1
1
1
1
3

cmBabbleControl = 0
cmConfigFreq1 = 666000000 Hz (shadowed from DOCSIS, DsFreq)
cmConfigFreq2 = 642000000 Hz
cmConfigFreq3 = 650000000 Hz
cmUpstreamChannelId1 = 3 (shadowed from DOCSIS, UsChan)
cmUpstreamChannelId2 = 16
cmUpstreamChannelId3 = 1
cmUpstreamPower1 = 53.50 dBmV (shadowed from DOCSIS, UsPower)
cmUpstreamPower2 = 54.0 dBmV
cmUpstreamPower3 = 54.0 dBmV
cmFactoryCodeSigningTime = (shadowed from BPI, Code Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactoryCVCValidityStartTime = (shadowed from BPI, CVC Access Start)
30 30 30 31 30 31 30 30 30 30 30 30 | 000101000000
cmFactorySwServer = 0.0.0.0 (shadowed from SNMP, docsDevSwServer)
cmFactorySwFilename = (unknown) (shadowed from SNMP, docsDevSwFilen
ame)
cmStandbyMode = 0
cmStandbyCapable = 0
cmSunboxCapable = 0
cmDhcpUnicastTrafficOnly = 0
cmConfigGuiHfcAccessEnable = 0
cmConfigEnableAllEventLogPriorities = 0
cmConfigT3TimeoutInitRngRetries = 
fCmFreqCustomListEntries = 0
fCmDocsis1xHackFor20CmtsEnable = 0
fDocsDevSTPControl = 
fCmClearUpstreamFavChanID = 0
+--------------------------------------+
| VendorSecureFactoryMibNonVolSettings |
+--------------------------------------+
Magic Number = 0x464d6962 'FMib'
Version (Permanent) = 0.1
Version (Dynamic) = 0.1
Is Default (Permanent) = 0
Is Default (Dynamic) = 0
Is Manufactured (Permanent) = 1
Is Manufactured (Dynamic) = 1
Vendor NonVol Settings:
FmibTimerCounter = 0
FmibUserLevel = 0
CM/NonVol> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> ls
!
find_command
man

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]
CM> cd flash
Active Command Table: Flash Driver Commands (flash)
CM -> flash
CM/Flash> show
Flash Device Information:
CFI Compliant:
Command Set:
Device/Bus Width:
Little Word Endian:
Fast Bulk Erase:
Multibyte Write:
Phys base address:
Uncached Virt addr:
Cached Virt addr:
Number of blocks:
Total size:
Current mode:

yes
Intel Standard Flash
x16
no
no
1 bytes max
0x1e000000
0xbe000000
0x9e000000
39
2097152 bytes, 2 Mbytes
Read Array

Size Device
Device
Region
Block kB Address
Offset
Offset Region Allocation
----- ---- ---------- ----------- --------- ----------------0
8 0xbe000000
0
0 Bootloader
1
8 0xbe002000
8192
8192 Bootloader
2
8 0xbe004000
16384
16384 Bootloader
3
8 0xbe006000
24576
24576 Bootloader (32768 bytes)
4
8 0xbe008000
32768
0 Permanent NonVol
5
8 0xbe00a000
40960
8192 Permanent NonVol
6
8 0xbe00c000
49152
16384 Permanent NonVol
7
8 0xbe00e000
57344
24576 Permanent NonVol (3----- ---- --------- ----------- --------- ----------------0
8 0xbe000000
0
0 Bootloader
1
8 0xbe002000
8192
8192 Bootloader
2
8 0xbe004000
16384
16384 Bootloader
3
8 0xbe006000
24576
24576 Bootloader (32768 bytes)
4
8 0xbe008000
32768
0 Permanent NonVol
5
8 0xbe00a000
40960
8192 Permanent NonVol
6
8 0xbe00c000
49152
16384 Permanent NonVol
7
8 0xbe00e000
57344
24576 Permanent NonVol (32768 bytes)
8 64 0xbe010000
65536
0 Image1
9 64 0xbe020000
131072
65536 Image1
10 64 0xbe030000
196608
131072 Image1
11 64 0xbe040000
262144
196608 Image1

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64
64

0xbe050000
0xbe060000
0xbe070000
0xbe080000
0xbe090000
0xbe0a0000
0xbe0b0000
0xbe0c0000
0xbe0d0000
0xbe0e0000
0xbe0f0000
0xbe100000
0xbe110000
0xbe120000
0xbe130000
0xbe140000
0xbe150000
0xbe160000
0xbe170000
0xbe180000
0xbe190000
0xbe1a0000
0xbe1b0000
0xbe1c0000
0xbe1d0000
0xbe1e0000
0xbe1f0000

327680
393216
458752
524288
589824
655360
720896
786432
851968
917504
983040
1048576
1114112
1179648
1245184
1310720
1376256
1441792
1507328
1572864
1638400
1703936
1769472
1835008
1900544
1966080
2031616

262144
327680
393216
458752
524288
589824
655360
720896
786432
851968
917504
0
65536
131072
196608
262144
327680
393216
458752
524288
589824
655360
720896
786432
851968
917504
0

Image1
Image1
Image1
Image1
Image1
Image1
Image1
Image1
Image1
Image1
Image1 (983040 bytes)
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2
Image2 (983040 bytes)
Dynamic NonVol (65536 bytes)

CM/Flash> dir
!
find_command
man
usage
---autoTest
erase
show
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

cfi_show
init
write

close
open
writeArray

configRegion
read

deinit
readDirect

dir
ls
system_time

CM/Flash> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> show
Error - Unknown command: 'show'
CM> dir
!
find_command
man
usage
---con_high
read_memory
stackShow

?
help
pwd

REM
history
sleep

cd
instances
syntax

mbufShow
reset
taskDelete

memShow
routeShow
taskInfo

mutex_debug
ping
run_app
shell
taskPrioritySet taskResume

taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]
[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]
[usb_hal]
CM> cd docsis_ctl
Active Command Table: CM DOCSIS Control Thread Commands (docsis_ctl)
CM -> docsis_ctl
CM/DocsisCtl> showFlows
show
Dynamic Service STDs:
DS flow

SFID: 0x2829 (10281)

Ref: 0xa (10)

US flow

SFID: 0x1d80 (7552)

US flow

SFID: 0x28d4 (10452)

Ref: 0x2 (2)

DS flow

SFID: 0x293a (10554)

Ref: 0xb (11)

Ref: 0x1 (1)

State: Nominal
State: Nominal
State: Nominal
State: Nominal

Installed Flow Settings:


BcmLinkedQosFlowSetsList:
fUsageContext =
fPrimaryUsCmFlowRef =
fPrimaryDsCmFlowRef =
fPrimaryUsSfid =
fPrimaryDsSfid =
fPrimarySid =

5 (kRegRsp)
0 (0)
0 (0)
0x1d80 (7552)
0x2829 (10281)
0x11f0 (4592)

fLinkedFlowSetsList.size() = 4
=========================
BcmLinkedQosFlowSettings:
DS flow. sfid=0x2829 CM flow ref=0xa
=========================
BcmLinkedQosFlowSettings:
US flow. sfid=0x1d80 sid=0x11f0 CM flow ref=0x1
=========================
BcmLinkedQosFlowSettings:
US flow. sfid=0x28d4 sid=0xebf CM flow ref=0x2
classifiers:
CMTS classifier id=0x1 CM classifier ref=0xc
CMTS classifier id=0x2 CM classifier ref=0xd
CMTS classifier id=0x3 CM classifier ref=0xe

CMTS
CMTS
CMTS
CMTS
CMTS
CMTS

classifier
classifier
classifier
classifier
classifier
classifier

id=0x4
id=0x5
id=0x6
id=0x7
id=0x8
id=0x9

CM
CM
CM
CM
CM
CM

classifier
classifier
classifier
classifier
classifier
classifier

ref=0xf
ref=0x10
ref=0x11
ref=0x12
ref=0x13
ref=0x14

=========================
BcmLinkedQosFlowSettings:
DS flow. sfid=0x293a CM flow ref=0xb
classifiers:
CMTS classifier
CMTS classifier
CMTS classifier
CMTS classifier
CMTS classifier
CMTS classifier
CMTS classifier

id=0xa
id=0xb
id=0xc
id=0xd
id=0xe
id=0xf
id=0x10

CM classifier ref=0x16
CM classifier ref=0x17
CM classifier ref=0x18
CM classifier ref=0x19
CM classifier ref=0x1a
CM classifier ref=0x1b
CM classifier ref=0x1c

CM/DocsisCtl> dir
!
?
REM
find_command
help
history
man
pwd
sleep
usage
---ClearCmCert
binarySfid
bpiShow
clear_image
comp_mac_to_phy comp_phy_to_mac
dsdiag
dsx_show
goto_ds
ip_initialize ip_show
l2vpn_show
modem_caps
rate_shaping_enable
showFlows
state
stop_download
up_dis
us_phy_oh_show usdiag
---[dsxTest] [propane_ctl]

cd
instances
syntax

dir
ls
system_time

cfg_hex_show
copy_image
goto_us
log_messages
rng_rsp
ucdShow

cfg_tlv_show
dload
igmpShow
map_debug
scan_stop
ucddiag

CM/DocsisCtl> cd ..
Active Command Table: CM DOCSIS Commands (CM)
CM
CM> ls
!
?
REM
cd
dir
find_command
help
history
instances
ls
man
pwd
sleep
syntax
system_time
usage
---con_high
mbufShow
memShow
mutex_debug
ping
read_memory
reset
routeShow
run_app
shell
stackShow
taskDelete
taskInfo
taskPrioritySet taskResume
taskShow
taskSuspend
taskTrace
usfsShow
version
write_memory
zone
---[HeapManager] [cm_hal] [docsis_ctl] [embedded_target] [enet_hal] [event_log]

[flash] [forwarder] [ip_hal] [msgLog] [non-vol] [pingHelper] [snmp] [snoop]


[usb_hal]
CM> read_memory
ERROR - Address is NULL!
CM> memshow
Error - Unknown command: 'memshow'
CM> memShow
Memory controlled by Brcm Heap Manager. Go to the 'HeapManager' directory and d
o a 'memShow' there to see memory stats.
CM> cd HeapManager
Active Command Table: HeapManager Commands (HeapManager)
CM -> HeapManager
CM/HeapManager> dir
!
find_command
man
usage
---bcheck
memShow
walk_alloc
----

?
help
pwd

REM
history
sleep

cd
instances
syntax

dir
ls
system_time

bcheck_crash
stats

bcheck_enable
threadUsage

last_error
trace

maxAlloc
walk

CM/HeapManager> memShow
BcmHeapManager info:
Total Heap Bytes Free
Largest
Low Water
------------ ------------ ------------ -----------2813952
328220
174912
65836
CM/HeapManager>
***
*** VERBINDUNGSABBRUCH
*** Uhrzeit 23:38:29
***

You might also like