Re: chaging your @home IP address... could you take a bunch ofthe m....probably... could you get something from it...maybe

From: TWyrickat_private
Date: Wed Feb 06 2002 - 12:08:04 PST

  • Next message: Jose Nazario: "Re: ssh"

    I was just reading up on this earlier today.
    Here in the U.S., AT&T cable seems to work exactly this way.
    
    (Apparently, COX Cable in the U.S. has much weaker security set up for
    throttling cable modem bandwidth, though.  Their network, last I heard,
    still allowed non DOCSIS compliant modems on it.  Software hacks exist that
    toy with the ARP address entries and trick these older cable modems into not
    capping bandwidth at all on the COX network.)
    
    I've heard rumors that people have successfully modified DOCSIS modems to be
    permanently "uncapped" by cutting a couple of resistors inside the modem
    after updating the firmware with new QOS settings.
    (That way, the modem tftp's down the cable company's throttling settings
    when it first boots up on the cable network, but doesn't really update its
    internal firmware with the file.)
    
    In fact, I understand that not only are there settings for maximum bandwidth
    for up and download, but perhaps more importantly, there is a "priority"
    setting.  Cable companies usually leave it set to a value of 0, but it can
    be bumped up as high as 7.  If everyone else's cable modem is set to
    priority 0 and yours has a different value, your transfers take precedence
    over everyone else's on your subnet.
    
    Now - AT&T and others do hire people who monitor bandwidth usage with
    software analysis tools; so even if you give yourself lots of bandwidth with
    a hack like this, I wouldn't be surprised if your service suddenly gets shut
    off!
    
    
    >In the states many companies will let you buy DOCSIS modems, here in Canada
    >however, most Cable ISP's are not at that stage currently. Some have
    >implemented DOCSIS on their networks (Including the one that I work for).
    >
    >The way the modems are throttled are by config files (And possibly via SNMP
    >management as well), so to unthrottle the modem (And the modems should be
    >capable of 10mbps both directions if not more) you would need to replace
    the
    >modems config file.
    >
    >However, attempts to hack the config file and replace it with your own can
    >be very difficult (Not saying it's not doable, but in all my trying on our
    >network I haven't been able to). They have shared encrypted secrets in the
    >DOCSIS config files, so even if you do manage to replace the config file on
    >your modem with another one (Very difficult to do) the cable router will
    not
    >accept the modem because the shared secret does not match.
    >
    >Also, the config file is specified on boot up by the Cable ISP's DHCP
    server
    >(It should specify the TFTP server and the config file to download). So the
    >challenge is, to spoof the DHCP server responses and force the modem to
    >download a config file from your TFTP server.
    



    This archive was generated by hypermail 2b30 : Wed Feb 06 2002 - 12:40:28 PST