Kitz Forum
Broadband Related => Broadband Technology => Topic started by: GigabitEthernet on June 12, 2012, 05:43:07 PM
-
I stumbled across an official Broadcom app for line diagnostics. It lets one run QLN tests etc.
It can be downloaded from here (ftp://ftp.zoomtel.com/pub/DslDiag.zip).
To use it:
1. Open the CMD prompt and "cd" to the extracted folder containing the Broadcom app.
2. If you are using a NETGEAR router, visit this address (http://192.168.0.1/setup.cgi?todo=dsldiag) in your web browser, otherwise, disregard this step.
3. Type "bcmdsldiagsl -s ROUTERIP.
That's it. Have fun!
WARNING: There are some features of this program which if you don't know what you are doing, could be dangerous. You have been warned.
-
Well spotted! That looks very interesting, and it works on Linux with Wine too.
-
Three exe files. I wonder if they are worth disassembling, analysing and re-writing in C, ready for recompilation -- for Linux kernel based systems . . . ::)
-
Are you volunteering? :)
There are good disassembling tools in Linux, but the analysing and rewriting parts would be way beyond my (in)competence.
-
Very interesting indeed! Good find, arobertson545 :-[ ! Where did you discover it? Other than this forum, I can only find one place where the tool is discussed..
http://www.thesafehouse.org/forums/showthread.php?t=35903
cheers, a
-
Are you volunteering? :)
I'll have a look. But I might end up volunteering Asbokid :o because it has been so long since I last did anything like that! :D
-
Very interesting indeed! Good find, rizla! Where did you discover it?
Eh? ??? I see no rizla! What have you been drinking, that I have not? :drunk:
-
Very interesting indeed! Good find, rizla! Where did you discover it?
Eh? ??? I see no rizla! What have you been drinking, that I have not? :drunk:
Oops! A blunder caused by a lack of the ethanolic elixir! Sorry, ar545!
cheers, a
-
I stumbled across an official Broadcom app for line diagnostics. It lets one run QLN tests etc.
It can be downloaded from here (ftp://ftp.zoomtel.com/pub/DslDiag.zip).
To use it:
1. Open the CMD prompt and telnet to the extracted folder containing the Broadcom app
2. Type "bcmdsldiagsl -s ROUTERIP
That's it. Have fun!
WARNING: There are some features of this program which if you don't know what you are doing, could be dangerous. You have been warned.
how does one telnet to a folder?
EDIT: Im not telnetting but ive managed to open it from cm prompt but it just says SOCKET CONNECTING and does nothing?
it looks like it might be good too :)
-
He didn't mean 'telnet'. You CD to the directory where the files are extracted, then type
bcmdsldiagsl -s 192.168.0.1 (or whatever the IP address of your router is)
-
He didn't mean 'telnet'. You CD to the directory where the files are extracted, then type
bcmdsldiagsl -s 192.168.0.1 (or whatever the IP address of your router is)
Thank you for spotting that roseway. I have updated the original post.
-
Very interesting indeed! Good find, arobertson545 :-[ ! Where did you discover it?
On a reply to a post I made about the Zoom X7N on Amazon! I was replied to with a link to the Zoom FTP site and I downloaded it.
Can anybody confirm that it works with other routers like the NETGEAR DG834GT, etc?
-
It works perfectly with the D-Link DSL-2740B
-
Please can someone say what happens after the application starts. I also just get a "Socket Connecting....." and nothing else.
I am using a DG834G v4 with DGTeam but I assume that irrespective of the router and firmware it still needs to login?? Maybe it uses a port disabled with DGteam. I could try the Netgear firmware or a Dlink 2640b but wondered what should come after "socket connecting".
-
It shows "Socket connecting" if you start it without specifying the router IP address, or if you give it the wrong address. Are you sure you're entering the IP address of your router correctly?
-
Could anyone post a screen shot or two of what this does?
-
This is one view of it. I don't understand half of it at the moment. In particular, I don't know what the 'eye displays' are, but they're fun to watch. :)
-
Thanks Eric, but yes it is all correct and still "socket connecting.. ". As I said maybe a port is not open?
-
Thanks Eric, but yes it is all correct and still "socket connecting.. ". As I said maybe a port is not open?
I really don't know, I'm afraid. Maybe it's a problem with Netgear routers? Or it might be using an anonymous telnet interface which isn't available in the DGTeam firmware. Just speculation...
-
Thanks Eric, but yes it is all correct and still "socket connecting.. ". As I said maybe a port is not open?
Just a thought, maybe telnet needs to be manually enabled prior to running the program:-
httP://192.168.0.1/setup.cgi?todo=debug (http://192.168.0.1/setup.cgi?todo=debug)
-
Still no luck, I will try other firmware and a Dlink 2640b this evening
-
it does this wth the IP Address too as I worked out thats what you had to do... I just get socket connecting... I too am using DG Team firmware on an 834N , what are you using AR545..? Netgear fw DGN2000? I cant remember now
-
there is even a DSLDIAG enable link in asbo's link to that website that mentions it , I tried that with no success.. I think its DG Team FW... right... wheres that 834GT amd my flash util!!! hehe
-
Very interesting indeed! Good find, arobertson545 :-[ ! Where did you discover it?
On a reply to a post I made about the Zoom X7N on Amazon! I was replied to with a link to the Zoom FTP site and I downloaded it.
Can anybody confirm that it works with other routers like the NETGEAR DG834GT, etc?
The Broadcom diagnostic client is trying to connect to udp/5100 on the router. On the Huawei HG612, there's nothing listening on that port, so it just hangs with a "Socket Connecting.." message.
No. Time Source Destination Protocol Length srcport dstport
1 0.000000 192.168.1.3 192.168.1.1 UDP 60 2138 5100
Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: CadmusCo_51:be:70 (08:00:27:51:be:70), Dst: AskeyCom_c0:b8:41 (b4:74:9f:c0:b8:41)
Internet Protocol Version 4, Src: 192.168.1.3 (192.168.1.3), Dst: 192.168.1.1 (192.168.1.1)
User Datagram Protocol, Src Port: 2138 (2138), Dst Port: 5100 (5100)
Data (4 bytes)
0000 2a 4c 80 ff *L..
No. Time Source Destination Protocol Length srcport dstport
2 0.019836 192.168.1.3 192.168.1.1 UDP 60 2138 5100
Frame 2: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: CadmusCo_51:be:70 (08:00:27:51:be:70), Dst: AskeyCom_c0:b8:41 (b4:74:9f:c0:b8:41)
Internet Protocol Version 4, Src: 192.168.1.3 (192.168.1.3), Dst: 192.168.1.1 (192.168.1.1)
User Datagram Protocol, Src Port: 2138 (2138), Dst Port: 5100 (5100)
Data (4 bytes)
0000 2a 4c 80 ff *L..
No. Time Source Destination Protocol Length srcport dstport
3 0.040092 192.168.1.3 192.168.1.1 UDP 60 2138 5100
Frame 3: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: CadmusCo_51:be:70 (08:00:27:51:be:70), Dst: AskeyCom_c0:b8:41 (b4:74:9f:c0:b8:41)
Internet Protocol Version 4, Src: 192.168.1.3 (192.168.1.3), Dst: 192.168.1.1 (192.168.1.1)
User Datagram Protocol, Src Port: 2138 (2138), Dst Port: 5100 (5100)
Data (4 bytes)
0000 2a 4c 80 ff *L..
[...]
cheers, a
-
just tried with a DG834GT with both DGTeam and Netgear Firmware and still "socket connecting" :(
@ AR545 - what router you having success with?
@ ASBOKID - is there no way of forcing the router to listen on that port (unfamiliar with it myself)
edit: tried creating services on port 5100-5102 on UDP and then allowed them in firewall rules, both ways and results are same :(
edit2: tried adding an ALG Service on UDP port 5100...no joy :(
-
@ AR545 - what router you having success with?
Zoom X7N. Roseway seems to have success, Roseway, what modem are you using? I didn't have to do any special configuration on my router, it worked out of the box.
-
This is one view of it. I don't understand half of it at the moment. In particular, I don't know what the 'eye displays' are, but they're fun to watch. :)
I believe they show the noise on a particular tone, you can configure what is shows on one of the menus.
-
Roseway, what modem are you using?
It's a D-Link DSL-2740B.
-
It works great on Dlink 2640B, but not on my DG834Gv4. Displays are nice but I don't dare try most of the other options!
-
It works great on Dlink 2640B, but not on my DG834Gv4. Displays are nice but I don't dare try most of the other options!
I'l try my DG834GT when I get the chance. I'll also post some more screenshots.
Edit: It does not work with the NETGEAR DG834GT. Screenshots will be added in due course.
-
Some screenshots attatched.
-
Edit: It does not work with the NETGEAR DG834GT.
Found a reference to BcmDslDiagsL.exe (http://www.thesafehouse.org/forums/showthread.php?t=35903) and that suggested using http://192.168.0.1/setup.cgi?todo=dsldiag (http://192.168.0.1/setup.cgi?todo=dsldiag).
Just tried it out and BcmDslDiagsL now works on my DG834GT.
-
Edit: It does not work with the NETGEAR DG834GT.
Found a reference to BcmDslDiagsL.exe (http://www.thesafehouse.org/forums/showthread.php?t=35903) and that suggested using http://192.168.0.1/setup.cgi?todo=dsldiag (http://192.168.0.1/setup.cgi?todo=dsldiag).
Just tried it out and BcmDslDiagsL now works on my DG834GT.
I can confirm that that works. If you don't mind, I have added that step to the first post.
-
Edit: It does not work with the NETGEAR DG834GT.
Found a reference to BcmDslDiagsL.exe (http://www.thesafehouse.org/forums/showthread.php?t=35903) and that suggested using http://192.168.0.1/setup.cgi?todo=dsldiag (http://192.168.0.1/setup.cgi?todo=dsldiag).
Just tried it out and BcmDslDiagsL now works on my DG834GT.
I tried that link last night on my 834N with DGteam fw... doesnt work... I guess I will try my 834GT again
the 834N has same chipset as the D-Link 2740B that Eric and Les have it working on...so should work? perhaps its the DGteam fw..?
-
Worked on my DG834G with DGTeam this time :). Thanks for the http://192.168.0.1/setup.cgi?todo=dsldiag advice.
-
ok, working on my DG834GT with Netgear FW... would not work with DGteam firmware (even with dsldiagdebog link) and does not work on my 834N with DGteam..i bet it would work on it with Netgear FW though
i will run some of the tests later as its my spare router... or i may run them on my Speedtouch 585v6 (should work on that?)
-
or i may run them on my Speedtouch 585v6 (should work on that?)
I doubt it, the Thomson routers always used/use a custom CLI that I doubt is compatible with this app. I am happy to be proven wrong however :).
-
I can confirm that you need to use the DLSDIAG DEBUG link on Netgears to get it working...
i dunno what most of this stuff is or what the tests are doing (or if they are even running?) I run a QLN test which completed and graphed out my QLN with a few more graphs overlapping almost exactly the same as the QLN...
it seems to have a bug where it reports the actual sync rate at 4544 / 544 sometimes
anyone find anything of use/new ? I cant do anything just now as 'pops' is using other PC and the wireless is dropping cos the Netgear wg111t stick is poop
-
Hmmm, wonder if there is a corresponding URL to enable it on the HG612, as there is plenty of reference in the program to VDSL & VDSL2.
Perhaps asbo may be aware of a URL from his earlier work on unlocking ?
-
Hmmm, wonder if there is a corresponding URL to enable it on the HG612, as there is plenty of reference in the program to VDSL & VDSL2.
Perhaps asbo may be aware of a URL from his earlier work on unlocking ?
Hi, Blackeagle,
It works fine on the HG612. However, sfaics, there's no hidden URL in the Huawei's web GUI to enable the diagnostic daemon.
So, log in as normal via telnet, and start the daemon (dsldiagd) from the shell:
BusyBox v1.9.1 (2010-10-15 17:59:06 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# dsldiagd &
#
Check it's running with:
# netstat -lu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:snmp 0.0.0.0:*
udp 0 0 0.0.0.0:domain 0.0.0.0:*
udp 0 0 92.26.201.144:1718 0.0.0.0:*
udp 0 0 0.0.0.0:bootps 0.0.0.0:*
udp 0 0 0.0.0.0:tftp 0.0.0.0:*
udp 0 0 0.0.0.0:5098 0.0.0.0:*
udp 0 0 0.0.0.0:5099 0.0.0.0:*
udp 0 0 0.0.0.0:5100 0.0.0.0:*
#
And there at the bottom, listening on 5100/udp is the control socket of dsldiagd, the diagnostic daemon.
That should work for all modems with dsldiagd included in their firmware.
After starting the daemon, the telnet session can be closed.
And as Roseway has noted, the diagnostic client for the client runs okay in Linux using WINE.
(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fwww1.picturepush.com%2Fphoto%2Fa%2F8494464%2F480%2Farobertson545%2Fbroadcomdiagnostictoolscreenshot.png&hash=b8d7f48eae9f0249f3a632db0ac0457ea086c0e1) (http://picturepush.com/public/8494464)
It looks like the graphs are showing QAM constellation maps for two different tones. The left one (Main Eye display) is for a tone in active service, the right one is for the pilot tone (DMT#64 in this case).
Great find arobertson545!
cheers, a
EDIT:
For anyone wanting to modify the firmware (revision 1.0.3-2) of the Zoom ADSL X7N 5790 [1], it unpacks okay:
asbo@home:~/zoom_x7n_5790$ wget http://www.zoomtel.com/files/adsl/5790_Firmware-v103-2.zip
asbo@home:~/zoom_x7n_5790$ unzip 5790_Firmware-v103-2.zip
Archive: 5790_Firmware-v103-2.zip
inflating: 5790_Firmware-v103-2/ReadMe.html
inflating: 5790_Firmware-v103-2/Zoom_X7n_v1.0.3-2_en.BIN
asbo@home:~/zoom_x7n_5790$ cd 5790_Firmware-v103-2/
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ ls -l
total 5436
-rw-r--r-- 1 asbokid asbokid 5307 May 11 15:02 ReadMe.html
-rw-r--r-- 1 asbokid asbokid 5555303 May 8 08:31 Zoom_X7n_v1.0.3-2_en.BIN
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ xxd -l 256 Zoom_X7n_v1.0.3-2_en.BIN
0000000: 3600 0000 4272 6f61 6463 6f6d 2043 6f72 6...Broadcom Cor
0000010: 706f 7261 7469 6f00 7665 722e 2032 2e30 poratio.ver. 2.0
0000020: 0000 0000 0000 3633 3238 0000 3936 3332 ......6328..9632
0000030: 3841 564e 4700 0000 0000 0000 3100 3535 8AVNG.......1.55
0000040: 3535 3034 3700 0000 3000 0000 0000 0000 55047...0.......
0000050: 0000 0000 3000 0000 0000 0000 0000 3332 ....0.........32
0000060: 3137 3039 3639 3630 0000 3434 3831 3032 17096960..448102
0000070: 3400 0000 3332 3231 3537 3739 3834 0000 4...3221577984..
0000080: 3130 3734 3032 3300 0000 0000 0000 0000 1074023.........
0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000d0: 0000 0000 0000 0000 74a3 fda3 ae05 2d6c ........t.....-l
00000e0: f6a4 5eba 0000 0000 0000 0000 0bb9 8f40 ..^............@
00000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ analyzetag -t bc310 -i Zoom_X7n_v1.0.3-2_en.BIN
Broadcom image analyzer - v0.1.0
Copyright (C) 2009 Daniel "The Duke" Dickinson
Tag Version: 6
Signature 1: Broadcom Corporatio
Signature 2: ver. 2.0
Chip ID: 6328
Board ID: 96328AVNG
Bigendian: true
Image size: 0054c367, 5555047
CFE Address: 00000000, 0
CFE Length: 00000000, 0
Flash Root Address: bfc10100, 3217096960
Flash Root Length: 00446000, 4481024
Flash Kernel Address: c0056100, 3221577984
Flash Kernel Length: 00106367, 1074023
Vendor information:
Image CRC: 74a3fda3 [Computed Value: 74a3fda3]
Rootfs CRC: [Computed Value: 6c2d05ae]
Image CRC from sections: 74a3fda3 [Computed Value: 74a3fda3]
Header CRC: 0bb98f40 [Computed Value: 0bb98f40]
Kernel CRC: f6a45eba [Computed Value: f6a45eba]
Rootfs CRC: ae052d6c [Computed Value: ae052d6c]
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ dd if=Zoom_X7n_v1.0.3-2_en.BIN of=HDR bs=1 count=256
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ dd if=Zoom_X7n_v1.0.3-2_en.BIN of=ROOTFS bs=1 skip=256 count=4481024
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ dd if=Zoom_X7n_v1.0.3-2_en.BIN of=KERNEL bs=1 skip=$((256+4481024))
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ ls -l
total 10868
-rw-r--r-- 1 asbokid asbokid 256 Jun 13 17:59 HDR
-rw-r--r-- 1 asbokid asbokid 1074023 Jun 13 18:04 KERNEL
-rw-r--r-- 1 asbokid asbokid 5307 May 11 15:02 ReadMe.html
-rw-r--r-- 1 asbokid asbokid 4481024 Jun 13 18:04 ROOTFS
-rw-r--r-- 1 asbokid asbokid 5555303 May 8 08:31 Zoom_X7n_v1.0.3-2_en.BIN
asbo@home:~/zoom_x7n_5790/5790_Firmware-v103-2$ 7z l ROOTFS
7-Zip [64] 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=en_GB.utf8,Utf16=on,HugeFiles=on,8 CPUs)
Listing archive: ROOTFS
--
Path = ROOTFS
Type = SquashFS
File System = SquashFS-LZMA 4.0
Method = LZMA ZLIB
Block = 65536
Physical Size = 4481024
Headers Size = 14805
Big-endian = -
Created = 2012-05-05 08:56:27
Characteristics = DUPLICATES_REMOVED EXPORTABLE
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2012-05-05 08:55:15 D.... bin
2012-05-05 08:56:21 D.... data
2012-05-05 08:56:22 D.... dev
2012-05-05 08:56:21 D.... etc
2012-05-05 08:56:21 D.... lib
2012-05-05 08:56:20 ..... 11 11 linuxrc
2012-05-05 08:56:20 D.... mnt
2010-09-25 00:58:48 D.... opt
2012-05-05 08:56:20 D.... proc
2012-05-05 08:54:11 D.... sbin
2012-05-05 08:56:20 D.... sys
2012-05-05 08:52:19 D.... usr
2012-05-05 08:56:21 D.... var
2012-05-05 08:53:49 D.... webs
2012-05-05 08:56:20 ..... 7 7 bin/adsl
2012-05-05 08:56:20 ..... 7 7 bin/adslctl
2012-05-05 08:56:21 ..... 81228 17525 bin/bcmupnp
2012-05-05 08:56:21 ..... 35416 16962 bin/brctl
2012-05-05 08:56:21 ..... 219668 87762 bin/busybox
2012-05-05 08:56:20 ..... 7 7 bin/cat
2012-05-05 08:56:20 ..... 7 7 bin/chmod
2012-05-05 08:56:21 ..... 6335 0 bin/consoled
2012-05-05 08:56:20 ..... 7 7 bin/cp
2012-05-05 08:56:20 ..... 7 7 bin/date
2012-05-05 08:56:21 ..... 15440 0 bin/ddnsd
2012-05-05 08:56:20 ..... 7 7 bin/deluser
2012-05-05 08:56:20 ..... 7 7 bin/df
2012-05-05 08:56:21 ..... 157152 56098 bin/dhcp6c
2012-05-05 08:56:21 ..... 142460 50801 bin/dhcp6s
2012-05-05 08:56:20 ..... 6 6 bin/dhcpc
2012-05-05 08:56:20 ..... 6 6 bin/dhcpd
2012-05-05 08:56:20 ..... 7 7 bin/dmesg
2012-05-05 08:56:21 ..... 40120 14526 bin/dnsproxy
2012-05-05 08:56:21 ..... 3868 0 bin/dnsspoof
2012-05-05 08:56:21 ..... 16976 0 bin/dsldiagd
2012-05-05 08:56:20 ..... 6 6 bin/dumpmem
2012-05-05 08:56:21 ..... 49776 9046 bin/eapd
2012-05-05 08:56:21 ..... 68628 21949 bin/ebtables
2012-05-05 08:56:20 ..... 7 7 bin/echo
2012-05-05 08:56:21 ..... 35128 16867 bin/epi_ttcp
2012-05-05 08:56:21 ..... 11064 0 bin/ethctl
2012-05-05 08:56:21 ..... 51864 11770 bin/ethswctl
2012-05-05 08:56:20 ..... 7 7 bin/false
2012-05-05 08:56:20 ..... 5 5 bin/fc
2012-05-05 08:56:21 ..... 8920 0 bin/fcctl
2012-05-05 08:56:20 ..... 7 7 bin/flash_eraseall
2012-05-05 08:56:21 ..... 6944 23083 bin/hotplug
2012-05-05 08:56:21 ..... 401712 112325 bin/httpd
2012-05-05 08:56:21 ..... 183144 56136 bin/ip
2012-05-05 08:56:21 ..... 115028 35064 bin/ip6tables
2012-05-05 08:56:21 ..... 88604 28196 bin/iptables
2012-05-05 08:56:20 ..... 7 7 bin/kill
2012-05-05 08:56:21 ..... 56424 0 bin/lld2d
2012-05-05 08:56:20 ..... 7 7 bin/ln
2012-05-05 08:56:20 ..... 7 7 bin/ls
2012-05-05 08:56:21 ..... 108375 20374 bin/mcpd
2012-05-05 08:56:20 ..... 7 7 bin/mkdir
2012-05-05 08:56:20 ..... 7 7 bin/mknod
2012-05-05 08:56:20 ..... 7 7 bin/mount
2012-05-05 08:56:21 ..... 5736 23029 bin/mroute
2012-05-05 08:56:20 ..... 7 7 bin/msh
2012-05-05 08:56:21 ..... 51892 0 bin/nas
2012-05-05 08:56:20 ..... 10 10 bin/nas4not
2012-05-05 08:56:21 ..... 3768 0 bin/nvram
2012-05-05 08:56:21 ..... 8120 22650 bin/nvramUpdate
2012-05-05 08:56:21 ..... 174048 53102 bin/openl2tpd
2012-05-05 08:56:21 ..... 267684 81624 bin/openssl
2012-05-05 08:56:20 ..... 7 7 bin/ping
2012-05-05 08:56:20 ..... 7 7 bin/ping6
2012-05-05 08:56:21 ..... 230480 86919 bin/pppd
2012-05-05 08:56:21 ..... 79564 19288 bin/pptp
2012-05-05 08:56:20 ..... 7 7 bin/ps
2012-05-05 08:56:20 ..... 7 7 bin/pwd
2012-05-05 08:56:21 ..... 471160 150739 bin/racoon
2012-05-05 08:56:21 ..... 57088 0 bin/radvd
2012-05-05 08:56:21 ..... 9896 4120 bin/rawSocketTest
2012-05-05 08:56:21 ..... 8835 0 bin/rewlmap
2012-05-05 08:56:21 ..... 84488 28040 bin/ripd
2012-05-05 08:56:20 ..... 7 7 bin/rm
2012-05-05 08:56:20 ..... 7 7 bin/sendarp
2012-05-05 08:56:21 ..... 86736 31743 bin/setkey
2012-05-05 08:56:20 ..... 6 6 bin/setmem
2012-05-05 08:56:20 ..... 7 7 bin/sh
2012-05-05 08:56:20 ..... 7 7 bin/sleep
2012-05-05 08:56:21 ..... 58063 13772 bin/smd
2012-05-05 08:56:21 ..... 108520 22277 bin/snmpd
2012-05-05 08:56:21 ..... 13328 10283 bin/sntp
2012-05-05 08:56:20 ..... 6 6 bin/spu
2012-05-05 08:56:21 ..... 6044 0 bin/spuctl
2012-05-05 08:56:21 ..... 195120 49656 bin/sshd
2012-05-05 08:56:21 ..... 77580 17287 bin/ssk
2012-05-05 08:56:21 ..... 191324 35877 bin/swmdk
2012-05-05 08:56:20 ..... 7 7 bin/sysinfo
2012-05-05 08:56:21 ..... 210932 67958 bin/tc
2012-05-05 08:56:21 ..... 14616 0 bin/telnetd
2012-05-05 08:56:20 ..... 7 7 bin/tftpd
2012-05-05 08:56:21 ..... 325884 51358 bin/tr64c
2012-05-05 08:56:21 ..... 233276 47576 bin/tr69c
2012-05-05 08:56:20 ..... 7 7 bin/true
2012-05-05 08:56:21 ..... 56492 21692 bin/udhcpd
2012-05-05 08:56:20 ..... 7 7 bin/umount
2012-05-05 08:56:21 ..... 99896 31276 bin/upnp
2012-05-05 08:56:21 ..... 39472 13163 bin/urlfilterd
2012-05-05 08:56:21 ..... 20852 0 bin/vlanctl
2012-05-05 08:56:20 ..... 5 5 bin/wl
2012-05-05 08:56:21 ..... 2172 0 bin/wlctl
2012-05-05 08:56:21 ..... 5668 11410 bin/wlevt
2012-05-05 08:56:21 ..... 7548 0 bin/wlmngr
2012-05-05 08:56:21 ..... 198496 38763 bin/wps_monitor
2012-05-05 08:56:21 ..... 81456 18062 bin/xdslctl
2012-05-05 08:56:20 ..... 6 6 bin/xtm
2012-05-05 08:56:21 ..... 38020 0 bin/xtmctl
2012-05-05 08:56:21 ..... 75616 25530 bin/zebra
2012-05-05 08:56:22 ..... 0 0 dev/ac97
2012-05-05 08:56:21 ..... 0 0 dev/bcm
2012-05-05 08:56:22 ..... 0 0 dev/bcm_omci
2012-05-05 08:56:22 ..... 0 0 dev/bcm_ploam
2012-05-05 08:56:22 ..... 0 0 dev/bcm_user_ploam
2012-05-05 08:56:21 ..... 0 0 dev/bcmaal20
2012-05-05 08:56:21 ..... 0 0 dev/bcmadsl0
2012-05-05 08:56:21 ..... 0 0 dev/bcmadsl1
2012-05-05 08:56:21 ..... 0 0 dev/bcmatm0
.... [snippage] ....
2012-05-05 08:53:49 ..... 925 0 webs/wlrefresh.html
2012-05-05 08:53:49 ..... 38771 0 webs/wlsecurity.html
2012-05-05 08:53:49 ..... 3678 0 webs/wlsetup.html
2012-05-05 08:53:49 ..... 9577 0 webs/wlwapias.html
2012-05-05 08:53:49 ..... 9674 1877 webs/xdslcfg.html
2012-05-05 08:53:49 ..... 1570 0 webs/zoommacflt.html
------------------- ----- ------------ ------------ ------------------------
16096806 4467189 579 files, 43 folders
[1] http://www.zoomtel.com/products/5790.html
-
I dont get any activity in constellation map (eye)
after faffing on with it on my 834GT I had wifi packet loss problems shortly afterwards...probably unrelated but reboots of router and pc would no resolve it.. I will reset and reflash it later and see if that restores it, im using my 834N now
so... can this do anything for us we couldnt do before?
can these tests help us find problems we couldnt before?
-
I dont get any activity in constellation map (eye)
You have to enable it. Under the View menu select Eye Display Configuration. Check the Enable box and click OK.
-
I dont get any activity in constellation map (eye)
You have to enable it. Under the View menu select Eye Display Configuration. Check the Enable box and click OK.
ahh i see, thanks Eric,
guess we'll have to wait for Asbo (our resident Scientist, hehe) to strip it down and figure it out..
-
Thanks asbo, it's working fine now, which is more than I can say for the M$ box it was running on lol
-
darn it!! DLM kicked in with all my reboots/resyncs lol... dropped me to the 16Mb profile with aggressive error correction INP=2 and 384 Interleaving lol - got it put back via sky forum PM...
anyone sussed out this tool yet?
the dsldiag debug link forces a re-sync just in case your not aware
-
This is a very significant find by arobertson545.
Just had a brief look with a packet sniffer at the traffic between the Broadcom diagnostic client (BcmDslDiagsL.exe) and the embedded server (dsldiagd) and the protocol doesn't look that complicated (famous last words, perhaps).
If that tickles the fancy of anyone here, maybe we can collaborate on reverse engineering it?
cheers, a
-
If you remember, I was scratching an itch in Reply #2 (http://forum.kitz.co.uk/index.php/topic,11293.msg218598.html#msg218598). :P Eric saw me scratching and he appeared to be interested (http://forum.kitz.co.uk/index.php/topic,11293.msg218612.html#msg218612), being a fellow Penguin Hugger.
After subsequent considerations, I declared (http://forum.kitz.co.uk/index.php/topic,11293.msg218618.html#msg218618) that the efforts of a higher status wizard would be required . . .
-
Attached is the C header holding the definitions for the network interface for the Broadcom DslDiag diagnostic daemon.
The file came from the source code tarball for the DG834GB v4. [1] The header file is identified as Revision 1.23, dated 2005/07/14, some seven years ago. Maybe there is a newer version out there?
Hopefully the header still contains enough info to re-create a PC client to obtain additional diagnostic stats from the DSL hardware driver layer.
In the same source tarball, the file DG834GBv4_V5.01.01_src/bcmdrivers/broadcom/char/adsl/bcm96348/BcmAdslDiagLinux.c has more info.
The BCM diagnostic tool - both client and daemon - remain closed source, but here [2] we get a glimpse at the codebase when an embedded developer asks for assistance with building the daemon under Hudson.
cheers, a
[1] http://huaweihg612hacking.wordpress.com/2011/07/26/broadcom-drivers-source-code/
[2] http://java.net/nonav/projects/hudson/lists/users/archive/2009-05/message/15
-
Much credit and thanks to arobertson545 for telling this forum about dsldiagd, the Broadcom diagnostic tool.
A basic DSL diagnostic client has been built in C for the host PC. It can interrogate the DSL diagnostic daemon running on the Broadcom target. The diagnostic tool uses a diagnostic network interface. That uses the UDP protocol on port 5100. The diagnostic data from the target is encoded in the UDP datagrams sent by the Broadcom daemon to the PC client.
But first of all, the daemon has to be woken up with some magic datagrams. Time synchronisation is also involved. Once initialised, the diagnostic daemon starts to report in a round-robin fashion perhaps fifty different types of line diagnostic data, each with its own 4-, 8- or 12- byte header in the datagram. Just half a dozen of these headers are understood to date.
Some types of diagnostic data, the line error counters for example, are readily identifiable (see below). But the most interesting data isn't yet decoded. Does anyone fancy working on this? It's a reverse engineering exercise. The source code is pretty crude at the moment. To be compatible with BillyGatesWare, tjat limits its design.
It looks like it's possible to get live QLN data using the tool. That is presumably achieved by disabling during showtime the bit-loading on a tone. That allows the background noise on the subcarrier to be measured. It would be great to reverse-engineer that specific functionality. At the moment though, the tool cannot get anything much that the xdslcmd doesn't already provide via the telnet interface. So nothing to get very excited about!
cheers, a
$ ./asbobcmdiagclient
Resetting dsldiagd on 192.168.1.1:5100
sent(0004) = ( 2a 4c 00 fc )
Waking up dsldiagd on 192.168.1.1:5100
sent(0004) = ( 2a 4c 80 ff )
sent(0004) = ( 2a 4c 80 ff )
recv(0004) = ( 2a 4c 41 ff )
Connected to server
sent(0020) = ( 2a 4c 00 ef 00 23 00 00 00 00 01 f4 00 00 00 00 00 00 00 00 )
sent(0004) = ( 2a 4c 00 fa )
sent(0020) = ( 2a 4c 00 ef 00 01 00 00 ff fe 00 00 00 00 00 04 00 00 00 00 )
recv(0061) = ( 2a 4c 01 f3 bd 9c 92 be 9b 8c 93 bc 90 8d 9a bb 96 9e 98 bc 92 9b c5 df 8f bb 9a 89 c2 cf 87 c7 .. )
recv(0083) = ( 2a 4c 01 f3 be bb ac b3 df 89 9a 8d 8c 96 90 91 df 96 91 99 90 c5 df af b7 a6 c2 be cd 8f 89 c9 .. )
recv(0060) = ( 2a 4c 01 30 00 00 01 06 00 00 01 70 01 00 00 2c a1 e0 00 00 a1 f0 00 00 00 0d f9 10 10 10 00 00 .. )
recv(0196) = ( 2a 4c 01 30 00 00 01 06 00 00 01 6f 01 00 00 b4 00 01 00 b4 63 68 00 b2 10 60 81 00 00 00 00 00 .. )
Version Info: - 0x636800B2 0x000100B4
recv(0052) = ( 2a 4c 01 f3 d5 d5 d5 df bb 8d 89 c5 df ac 9a 91 9b 96 91 98 df 9e 99 9a b6 9b d7 cf 87 ce cf c9 .. )
recv(0038) = ( 2a 4c 01 f3 bb 96 9e 98 df b7 9b 8d df be 9b 9b 8d c5 df c7 cf c7 cb ca c7 c7 cd d3 df ac 96 85 .. )
recv(0048) = ( 2a 4c 01 f3 bc 99 98 c2 cf 87 cf df 9a 86 9a ce c2 c9 cc df 9a 86 9a cd c2 c9 cb df 92 9e 87 b3 .. )
recv(0028) = ( 2a 4c 01 30 00 00 01 06 00 00 01 64 01 00 00 0c 00 bf 01 8a 00 00 00 00 00 00 00 00 )
recv(0012) = ( 2a 4c 01 30 00 00 00 2d 00 00 01 10 )
recv(0024) = ( 2a 4c 01 30 00 00 01 0c 00 00 00 5e 00 00 00 04 80 ba 14 8e 01 00 05 01 )
recv(0033) = ( 2a 4c 01 f3 ac 9a 91 9b 96 91 98 df bb 8c 93 bb 96 9e 98 8c df b7 9b 8d df 8b 90 df af b7 a6 f5 .. )
recv(0036) = ( 2a 4c 01 f3 b7 9b 8d df be 9b 9b 8d c2 cf 87 c7 cf c7 cb ca c7 c7 cd d3 df b7 9b 8d ac 96 85 9a .. )
recv(0036) = ( 2a 4c 01 f3 8c 8d 89 b2 be bc be 9b 9b 8d df c2 df ce cb c5 b9 ba c5 bd ca c5 be cd c5 cb cd c5 .. )
recv(0012) = ( 2a 4c 01 30 00 00 00 2d 00 00 01 36 )
recv(0020) = ( 2a 4c 01 30 00 00 01 06 00 00 00 65 02 24 00 80 10 1a 8d 0c )
recv(0020) = ( 2a 4c 01 30 00 00 01 06 00 00 00 67 00 25 00 80 10 1a 8d 0c )
recv(0020) = ( 2a 4c 01 30 00 00 01 06 00 00 00 65 02 25 00 80 10 1a 8d 8c )
recv(0020) = ( 2a 4c 01 30 00 00 01 06 00 00 00 67 00 26 00 80 10 1a 8c 8c )
recv(0024) = ( 2a 4c 01 30 00 00 01 06 00 00 00 66 01 36 00 07 01 00 05 01 54 8f 7e 89 )
recv(0024) = ( 2a 4c 01 30 00 00 01 0c 00 00 00 5d 00 00 00 04 c0 10 5d 20 01 00 05 01 )
recv(0068) = ( 2a 4c 01 30 00 00 01 0c 00 00 00 5e 00 00 00 30 80 23 36 a8 01 02 05 81 00 28 ef 7b 00 00 da 69 .. )
recv(0032) = ( 2a 4c 01 30 00 00 01 06 00 00 01 65 01 00 00 10 00 00 00 00 0e f6 ee 95 0e f5 09 c2 00 91 08 3a )
...
recv(0016) = ( 2a 4c 01 30 00 00 01 02 00 00 00 43 00 00 00 00 )
recv(0084) = ( 2a 4c 01 30 00 00 01 03 00 00 00 05 00 00 00 09 20 6e 04 15 20 27 1f 77 00 28 ef 7b 00 1d f5 23 .. )
RSWords GoodRS CorRS unCorRS SF SFErr rcvCRC rcvFEC rcvHEC rcvOCD rcvLCD HEC OCD LCD
544080917 539434871 2682747 1963299 3818113 55913 130 0 75 0 0 1714214 0 0
recv(0016) = ( 2a 4c 01 30 00 00 01 01 00 00 00 08 19 05 34 88 )
recv(0025) = ( 2a 4c 01 30 00 00 01 0c 00 00 00 5e 00 00 00 05 80 bd 5c 30 02 01 81 01 04 )
recv(0020) = ( 2a 4c 01 30 00 00 01 06 00 00 00 67 00 29 00 09 10 1a 8d 0c )
UNKNOWN CMD PARAM! (0067)
...
-
Superb progress. :thumbs:
Please keep up the good work. :)
-
Not sure I'll do much with it. Without collaboration, it's quite a big job to get it to something functional. However, the code can be uploaded - it's only about 20kB of C source. That might save unnecessary re-inventing of the wheel.
cheers, a
EDIT: Zip attached. It may or may not compile with mingw-gcc in Windows.
-
My problems are:
(1) Time deficiency.
(2) Not possessing any equipment that runs BillyGatesWare, with which to execute the original code. :-X
Perhaps one of the Eagles will be interested? :-\
-
I notice the file has now been removed :(. Would anybody like to host it? I can if necessary.
-
I notice the file has now been removed :(. Would anybody like to host it? I can if necessary.
Oh dear :o Now you see it, now you don't! Maybe behind the scenes there's been a twisting of someone's ears by Broadcom?!
cheers, a
-
Could somebody host it? I have lost my copy :(.
-
http://www.upload.ee/files/2487813/DslDiag.zip.html
MD5:9a6d0d8127e2c67c89da8f9298f52ad1
-
Good stuff Morphium! Welcome to the forum :)
-
I know this topic is old, but would this work with tp link 8960n if so how?
-
I think it should, but just about all the available knowledge on the tool is in this thread. Just guessing, you may need to start the dsldiag demon running in the router, as described by asbokid in relation to the HG612. Alternatively I might be talking nonsense.
-
It just says socket connecting when i send bcmdsldiagsl -s 192.168.1.1 the program starts but just says connecting?
-
That's discussed in the thread, but I can't add anything to it, I'm afraid.
-
BTW it can no loger be downloaded from original link
-
BTW it can no loger be downloaded from original link
Please use the link here: http://www.upload.ee/files/2487813/DslDiag.zip.html.
-
It just says socket connecting when i send bcmdsldiagsl -s 192.168.1.1 the program starts but just says connecting?
Have you tried telnetting into said router and running the command: dsldiagd?
-
No, how would i do this?
-
Would anyone be willing to captures some traffic in wireshark and send me the pcapng file?
I'd like to see if I can make any sense of the protocol/reverse engineered code but don't have a compatible router at the moment (will probably pickup a cheap one off ebay sometime) - but I can test with an emulator for now.
-
A really old post but, as I could find anywhere better, I thought I would add some details from experimenting here (I haven't done much, but at least one bit seems new):
Beyond the Eye views, the Status and the State summary there are 6 windows available:
Bit Allocation - Bitloading in a one histogram bar per tone
Gi Allocation (Gain) - The gain applied to each tone. My guess is in a perfect line this would be a straight line
SNR - Signal to Noise Ratio (contains Minimum and maximum as well as current
Showtime Margin - the Margin for each tone at the point of synchronisation
Channel Response - The HLog
Quiet Line Noise - Also shows Minimum and maximum when shown during the QLN Monitoring (from the tests menu)
-
When I was playing I put the modem into L3 State (idle, no connection)
QLN Monitoring uses the QLN view. There are 2 parameters, Duration and Frequency (forgot to screenshot so will edit next time I play with it).
The result is the QLN, along with a minimum and maximum over the time you set. It reverts to the last QLN if you shut the window.
-
In the AFE tests the two loopback tests fail, likely as they need a strap at the other end.
The Hybrid Response Test runs and produces a HLog Graph (of what I don't know yet :)). But it definitely relates to the QLN (mine's weird, and so is that HLog). The QLN is not the usual one - so I'll have to edit this again once I figure how I got it. The normal QLN is labelled SnrC and this one just QLN. There's a direct correlation between the peaks and troughs.
-
Placeholder
I did poke at lots of things, but hadn't thought to screen capture or document what I'd done (which I now wish I had). There may be more useful info so I'll keep a post for next time I have the modem disconnected.