Broadband Related > Router Monitoring Software

Getting extra DSL stats from TP-Link modem/routers

(1/22) > >>

ejs:
It should be possible to get more ADSL stats out of the TP-Link TD-W8970 than are shown in the web interface. The same method may work on similar TP-Link models. It can't get any per tone data, but it should get a few extra error counts.

I observed in wireshark while accessing the router web interface, and even just in that, I think you can see it retrieves more figures than the web page displays. The required names for further stats can be found looking in /etc/reduced_data_model.xml extracted from the firmware with binwalk.

A script to retrieve the stats is essentially one line, to run curl to make the necessary HTTP POST request, with the names of each item of requested data stored in a separate text file (attached). The value for the Authorization cookie could be copied out of wireshark, but it's just the value from http basic authorization (username:password base64 encoded).

An example script, the values for IP and AUTH (example is admin:password) would need to be changed as appropriate:

--- Code: ---IP="192.168.1.1"
AUTH="YWRtaW46cGFzc3dvcmQ="
curl --data-binary "@td-w8970-adsl-stats-post-all.txt" --referer=http://${IP}/ --header "Cookie: Authorization=Basic ${AUTH}" --header "Content-Type: text/plain; charset=UTF-8" "http://${IP}/cgi?1&5"
--- End code ---

Some names for some of the numbers can be found in /web/js/lib.js (again extracted from the firmware by binwalk).
It should be possible to get any value, or set any writable setting, in a similar way by making the appropriate HTTP POST request.
A "500 Internal Server Error" may be returned at random, this seems to happen occasionally while browsing the web interface anyway, it will probably work if you try it again.

I haven't connected the TD-W8970 to my phone line yet, so the list of names and values returned just has zeroes for most of the values.

Admin:  Edited topic title slightly because this also now covers several other TP-link models.

HighBeta:
Thanks for that.

The 8970 is a good lantiq vr9 unit.  {Same chipset at the ECI/r}
It will work on vdsl via a  vr9_firmware_bin swap mod  [{shh... as I think TP-Link reps read kitz } :))

dsl_cpe_consol --c        should be were the full line stats including tones are hiding  > bbsg 1 / bbsg 0.
:)

ejs:
Mine was supplied with the 131114 firmware, so the only way to install custom firmware or access a busybox shell would be via a serial connection. I suppose if you could access the busybox shell, then you wouldn't necessarily need to flash custom firmware, you could load VDSL stuff from a USB stick instead.

This method doesn't involve flashing a modified firmware and/or opening up the case and getting at the serial pins - there's only looking in the firmware file to see what's possible. So it's much more limited in what it can achieve, but it should be safer.

kitz:
Ive come over to this thread from the TD-W9980 for which TP-Link have b@stardised the firmware and removed access not only to the shell but telnet has also been disabled in the latest f/w version.

Im not really sure what Im doing here when it comes to what can be done next.

Ive run a wireshark capture and can see various data, but aside from a few things such as FECs and CRCs I cant see anything much else of use.

Heres a snippet of the best stuff


--- Code: ---134
[1,0,0,0,0,0]0
status=Up
modulationType=VDSL2
X_TPLINK_AdslModulationCfg=Multimode
upstreamCurrRate=20000
downstreamCurrRate=79995
X_TPLINK_AnnexType=Annex A/B/L/M
upstreamMaxRate=28292
downstreamMaxRate=82665
upstreamNoiseMargin=98
downstreamNoiseMargin=66
upstreamAttenuation=162
downstreamAttenuation=164

b1
[2,0,0,0,0,0]1
ATUCCRCErrors=70
CRCErrors=619
ATUCFECErrors=1305
FECErrors=12809
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0

b1
[3,0,0,0,0,0]1
ATUCCRCErrors=70
CRCErrors=619
ATUCFECErrors=1305
FECErrors=12809
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0
--- End code ---

There are a few other bits and pieces scattered through the file such as Up time and the connection details ie my ISP login details... and the firware version stuff, but nothing else of much interest that I can see.

ejs:
I'll try to write a small Java program to get the few extra stats that are available via these HTTP POST methods, which should be easier than fiddling about with curl, text files and shell scripts / batch files.

I don't know what's happened to telnet in the latest 9980 firmware, the firmware still contains the telnetd program, which is still started by the main init script. Not that the "cli" program that you're locked into offers much anyway. The reduced_data_model.xml file does have a setting which looks like it enables telnet but the default setting indicates it's enabled, there is also some sort of access control list settings for allowing certain IP addresses access to certain management interfaces. Although just because things are in the reduced_data_model.xml file doesn't actually mean they're in use, e.g. the TD-W8970 has various QoS items in the reduced_data_model.xml and config web pages, for prioritising traffic based on DSCP markings, but they don't work, there's only the bandwidth restrictions.

Navigation

[0] Message Index

[#] Next page