How a cable modem works (c. 2002)
support.usr.com
support.usr.com
> A DOCSIS channel can be graphed in the same fashion; however, instead of video, color, and audio information inside the MPEG-2 frames, it contains a data stream that represents computer information. Due to the "spectral shaping" of a data signal, there are no video or audio signals present, and the graph looks like Figure 2-3.
this seems wrong. i think figure 2-2 is an analog ntsc video channel and figure 2-3 is a digital mpeg-2 or docsis over mpeg-2 channel. both of the digital channels should have the same spectral envelope.
interesting that they put mpeg-2 headers on the data frames, probably "system" frames and done so for compatibility with existing headend and stb equipment.
Here's a sweep of all the channels (from 80 to 750 MHz) on my Comcast system. This was taken back in 2014, and there were still three NTSC channels (two of which were just a black frame and silence).
A zoom of the last channel at 729 MHz.
MPEG-2 Transport Streams are used for DOCSIS because it's baked into the QAM specification. It's built around 188 byte packets that start with 0x47.
https://wagtail-prod-storage.s3.amazonaws.com/documents/ANSI...
It's hard to imagine that just twenty years ago, we treated users far less like idiots, and gave them plenty of documentation even if they wouldn't read or understand it all.
In other words, “you’re now watching The Internet Channel(tm)”
I didn't know enough about networking at the time, but I recall seeing this at friends houses in maybe the late 90's. You could go into "Networking" in Windows, and see basically all the PCs on the street/neighborhood. I assume this was with the PC directly connected (no router) and maybe using WINS, but I'd be curious if there's more details behind why this could even happen. Did this also mean you'd be able to sniff other people's network traffic?
In the beginning of cable modem rollout, consumer routers were not yet common either, so most people were plugging straight into their modem. Cable companies encouraged this, and would charge for additional cable modems if you wanted to use more than one computer.
You couldn't connect a simple hub with multiple compuers to your cable modem back then either, IIRC because your MAC address had to be registered to their gateway, and it didn't really tolerate having multiple MAC addresses on the same cable modem. Which is why consumer routers started to get popular, because it allowed you to "share" your cable modem connection to multiple machines in the same home.
Edit: 1000100_1000101 explains the physical setup better than me: https://news.ycombinator.com/item?id=32302361
Essentially, routing done badly by ISP.
Each cable modem knew which devices were attached to them (IP and MAC). A dumb ISP would limit you to one MAC on the CM, even though it made no difference to them. Perhaps trying to upsell more connections. Everyone just got routers instead. The CM receives packets from the CMTS for everyone on your 20 mile stretch of cable. It needs to decode them to know who they're for, where one ends and where a new packet starts. An option, configured by the ISP and downloaded as you connect to the network, would tell your modem to either discard all traffic that didn't belong to a known device on your local subnet, or just spew absolutely everything out on your local ethernet. Many ISPs configured their modems to spew everything. Not only was this insecure, most PCs didn't handle all the ethernet interrupts gracefully either, and it could grind your PC to a halt.
CMs also supported encryption, optionally, at the discretion of the ISP (the "Baseline Privacy" you see in the article). Hardware assisted encryption was just rolling out, and only on some CMs, so many ISPs would have this off to improve throughput. DES or 3DES, and possibly another option was available at the time. Your CM and the CMTS would negotiate keys, rotate them with fresh ones every now and then (configurable duration). With this in place, your modem wouldn't be able to decode your 20 miles of neighbours traffic. Your data was secure, at least to the cable office, which could act as nefarious as they chose (why end to end encryption is ideal).
Traffic on another channel would never be decoded (unless the CMTS told your CM to switch channels, it could actively migrate you to optimize the network, shunt you off a channel whose hardware was about to be replaced, then move you back all seamlessly... there would be slight hiccup while it re-did ranging, etc).
Source: I used to write CM firmware for Docsis 2.0 modems in the late 90s.
BTW, I seem to recall that at least in early 2000s it was kinda popular to hack TFTP servers providing CM configuration files, to somehow change speeds available - was that really doable, or did retelling mangle the details?
The configuration was just a file. The file format was standardized to allow any modem to work I believe, so in theory someone could replace the configuration file without much effort. The ISP would know the CM MAC, possibly another identifier (it's been a while, I don't recall everything), to know what services/speeds to allow for a particular customer, and know which config to send them. If the ISP just make the filename for a customer the CM's MAC, it would be easy to replace for just one user. If it looked up which configuration to supply a customer from a database, you'd need to tweak that. As the configuration selection gets more complex, you might just get hackers replacing a config shared by hundreds or thousands of customers... the massive uptick in traffic that would cause would likely cause trouble. No idea how quickly they'd find the replaced config, but if it was affecting everyone on the same plan, I imagine they'd clue in pretty quick.
I'm not aware of how people abused the system or how the ISP configuration side was generally done, but it sounds plausible. What I don't recall if is the downstream bandwidth is actually listed in the CM config, since only the CMTS needs to know the limit on what it can send, or what upstream bandwidth to allow. A CM can request to download whatever it wants, but the CMTS will throttle your downstream and upstream bandwidth however it wants. If it's in the config, and if the CMTS reads and uses the same config, then sure.
Even if they were separate configs, and the CMTS config was non-standard, people may also just just copied the higher-end CMTS config over top of the lower-end one. Who knows.
But yeah, if you did it in a way that affected everyone, you'd probably cause enough trouble to get noticed pretty quickly.
I was under the impression that internet downstream and upstream are simply operating on different multiple QAM channels in different distinct frequency bands.
The document refers to "qam-lock" IMHO wrongly (I was a cable protocol/encryption wrangler in a previous life) - "qam-lock" is more a matter of tuning to a channel, sampling it to extract the signal (this means extracting a clock from it) then running the signal through enough of the error correction and framing logic so that you can extract the transport stream packets
That's "qam-lock" - at this point you still don't know what's in the stream - you could just look for 0x1ffe PIDs and decide you have DOCSIS - video qams will carry PAT tables in PID 0 which will point to PMTs (which can be in pid 0x1ffe) which in turn point to qams and PIDs containing video/audio/CA/etc (details vary greatly between implementations). Which is a long way of saying "just looking for PID 0x1ffe may not be enough"
It was a big deal back 10 years ago or so. I don't think it'd work nowadays.
MoCA: run your ethernet over the cable tv coax in your house