Comment by superuser2 | Hacker News Reader

Comment by superuser2 | Hacker News Reader

Parent Full thread

>Time Warner had left a backdoor in all their modems that gives them administrative access to my private connection

Yes, their modems. On the connection that they provide for you.

A cable modem is considered CPE (customer premise equipment), meaning it is part of the infrastructure a telco uses to provide you with connectivity. Usually they own it, but in any case they have full control over it, as they should - it's part of their network. They may choose to delegate some configuration via a web GUI, but that's at their discretion -it's theirs to administer.

Business telecom has a formalized notion of a demarc (demarcation point), the place where the telco network ends and yours begins. AT&T owns and is responsible for the fiber/T1/POTS lines as they come through the wall, as well as the CPE (often a large rackmount Cisco router) to which it connects. Their contract is to provide connectivity on specific ethernet ports/fibre GBICs/whatever of that CPE. Whatever happens downstream of those ports is your problem, and whatever happens upstream is their problem.

Both sides will treat this connection as hostile - you'll have your own NATing router up and the telco's router, if it even has a configuration interface listening on your NIC, won't let you in. It would be inappropriate for AT&T to have any sort of access to the router you own and inappropriate for you to attempt any sort of access to AT&T's CPE.

Time Warner has been shifting recently towards placing WiFi on their side of the (logical) demarc. Which makes sense, since most people would rather not be responsible for administering any infrastructure - they just want Time Warner to deliver them WiFi. It sounds like you have this kind of setup, in which case Time Warner's access is not "backdoor" but "building owner" - you're renting a room.

If you'd prefer, you can (have them) turn off their WiFi, go buy a nice wireless router, and connect it to the modem. In this case Time Warner is providing you with a connection on an ethernet port; the device you've plugged in is your own (your side of the demarc) and they have no right to touch its configuration, nor are they responsible for it working correctly.

EDIT: The obvious analogy that would have simplified much of this is that a cable modem is like an electrical meter.

Yeah, this is why I just shell out for my own docsys 3 cable modem whenever possible.

Even when you "bring your own modem" ISPs tend to demand exclusive control while it's in service. It really is intended to be part of the ISP's network rather than yours, so while (unlike a rental unit) you could walk away with it and take it to another provider, sell it, run your own copper infrastructure, etc. you usually still can't modify the settings of existing connection.

One of my cable installers told me that rate limiting is done in the cable modem, so people would run pirate firmware that eliminated the artifical limits and run at the natural limit of the connection. People had fun with this for a while until the network engineers figured it out, and now people exceeding the speed limit get their connections shut down pretty quickly. But anyway, it makes sense the the cable modem really isn't the customer's to control.

I own and control my own wireless router because I want to play with things like DD-WRT, use OpenDNS, etc., but I see the cable modem as no different from the utility box down the street.

Time Warner wants nothing to do with my (own purchased) cable modem beyond allowing me to use it. The vendor will only provide firmware patches to cable operators, and Time Warner won't touch my modem to help get the firmware upgraded.

I've always had naked DSL because of not wanting to pay for cable TV or another line. For DSL and similar services, BYOE tends to be hand-off.

With cable modems, does/can the provider push firmware?

With DOCSIS cable modems only the provider can update the firmware. And end user doesn't have the ability to update the firmware, even if they own the modem. That is part of the DOCSIS standard.

All the cable modems I've used (UK) have always downloaded a an image over TFTP on boot. As I understand it they can come up with a very minimal loader and reach out for their config to the local "node" for configuration, and this can include new firmware. On the support line they're adamant that you reboot the things before proceeding past the IVR. Which makes sense.

The last I heard about it the different levels of service (bronze/silver/gold they were at the time, 5/10/20Mbit/s) are just based on the MAC the modem sends on this initial config/handshake. When I moved from 20 to 50 I was told to reboot the modem and it came up will an all new shiny more craptastic than ever web interface as well as setting it's WAN port to 50Mbit/s

This doesn't help you at all.

The provider is able to change the settings through two primary methods.

1. DOCSIS configuration file - this is the file your modem downloads when it comes online and includes settings like your speeds (Upstream/Downstream service flows) and it also includes the SNMP settings (used for #2).

2. SNMP - The MSO can also remotely monitor and change your modem via SNMP. There is a large number of DOCSIS MIBs that every cable modem must support in order to get certified and there are also vendor specific MIBs that a modems manufacture will add to support specific features of that modem.

Without SNMP it would be very difficult to maintain a cable network. Other types of access networks have similar features.

Not sure I got that - why is cable different in this regard from DSL? I'm pretty sure there is such thing built into adsl/vdsl routers or modems, at least not in Germany.

DSL is provided over a POTS ("plain old telephone service") line. The demarc for POTS, at least in my neighborhood, is a grey box on the side of your house, well upstream of your DSL modem.

I don't know why exactly it worked out that way, but the telephone system is designed to deal with consumer electronics and the coax cable system is not.

It didn't used to be - until the federal government busted AT&T's monopoly, it was illegal to connect non-AT&T equipment to the AT&T network, at least electrically. This is why in old movies you see people dialing ISPs by hand with a phone and then setting the handset down on a cradle - the cradle was the modem, and it interfaced with the telephone network acoustically. The demarc (at least as we know it today) was presumably introduced after the government told AT&T they had to let people have their own networks, rather than considering everything up through the phones to be part of the telco network.

These are called VRADs http://en.wikipedia.org/wiki/VRAD.

The demarc for your DSL is the modem. If you provide your own modem you still are subject to AT&T's rules. You cannot legally connect to sensitive national infrastructure (like the phone network) without the provider being responsible for your access.

As far as connecting equipment, that significantly predates divestiture. Most people point to Carterfone as the salient decision that changed this: http://en.wikipedia.org/wiki/Carterfone

In reality, there was actually a prior decision which I can't seem to find right now where AT&T refused to allow people to put plastic privacy guards over the mouth piece on the grounds that it would damage the phone network. Ludicrous, but sensible from an economic standpoint.

EDIT: Found it, 1956 Hush-a-phone: http://en.wikipedia.org/wiki/Hush-A-Phone_v._United_States

In short, Telecom is complicated, the demarc is important and you don't own any part of the network from the modem on up.

Source: I am a telecom junkie and I work at 2600hz, the open source telecom company.

Reply on news.ycombinator.com