Kitz Forum

Broadband Related => Router Monitoring Software => Topic started by: ejs on September 01, 2014, 08:38:33 PM

Title: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on September 01, 2014, 08:38:33 PM
It should be possible to get more ADSL stats out of the TP-Link TD-W8970 than are shown in the web interface. The same method may work on similar TP-Link models. It can't get any per tone data, but it should get a few extra error counts.

I observed in wireshark while accessing the router web interface, and even just in that, I think you can see it retrieves more figures than the web page displays. The required names for further stats can be found looking in /etc/reduced_data_model.xml extracted from the firmware with binwalk.

A script to retrieve the stats is essentially one line, to run curl to make the necessary HTTP POST request, with the names of each item of requested data stored in a separate text file (attached). The value for the Authorization cookie could be copied out of wireshark, but it's just the value from http basic authorization (username:password base64 encoded).

An example script, the values for IP and AUTH (example is admin:password) would need to be changed as appropriate:
Code: [Select]
IP="192.168.1.1"
AUTH="YWRtaW46cGFzc3dvcmQ="
curl --data-binary "@td-w8970-adsl-stats-post-all.txt" --referer=http://${IP}/ --header "Cookie: Authorization=Basic ${AUTH}" --header "Content-Type: text/plain; charset=UTF-8" "http://${IP}/cgi?1&5"

Some names for some of the numbers can be found in /web/js/lib.js (again extracted from the firmware by binwalk).
It should be possible to get any value, or set any writable setting, in a similar way by making the appropriate HTTP POST request.
A "500 Internal Server Error" may be returned at random, this seems to happen occasionally while browsing the web interface anyway, it will probably work if you try it again.

I haven't connected the TD-W8970 to my phone line yet, so the list of names and values returned just has zeroes for most of the values.

Admin:  Edited topic title slightly because this also now covers several other TP-link models.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: HighBeta on September 01, 2014, 09:32:08 PM
Thanks for that.

The 8970 is a good lantiq vr9 unit.  {Same chipset at the ECI/r}
It will work on vdsl via a  vr9_firmware_bin swap mod  [{shh... as I think TP-Link reps read kitz } :))

dsl_cpe_consol --c        should be were the full line stats including tones are hiding  > bbsg 1 / bbsg 0.
:)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on September 01, 2014, 10:21:51 PM
Mine was supplied with the 131114 firmware, so the only way to install custom firmware or access a busybox shell would be via a serial connection. I suppose if you could access the busybox shell, then you wouldn't necessarily need to flash custom firmware, you could load VDSL stuff from a USB stick instead.

This method doesn't involve flashing a modified firmware and/or opening up the case and getting at the serial pins - there's only looking in the firmware file to see what's possible. So it's much more limited in what it can achieve, but it should be safer.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 12, 2014, 09:52:02 PM
Ive come over to this thread from the TD-W9980 for which TP-Link have b@stardised the firmware and removed access not only to the shell but telnet has also been disabled in the latest f/w version.

Im not really sure what Im doing here when it comes to what can be done next.

Ive run a wireshark capture and can see various data, but aside from a few things such as FECs and CRCs I cant see anything much else of use.

Heres a snippet of the best stuff

Code: [Select]
134
[1,0,0,0,0,0]0
status=Up
modulationType=VDSL2
X_TPLINK_AdslModulationCfg=Multimode
upstreamCurrRate=20000
downstreamCurrRate=79995
X_TPLINK_AnnexType=Annex A/B/L/M
upstreamMaxRate=28292
downstreamMaxRate=82665
upstreamNoiseMargin=98
downstreamNoiseMargin=66
upstreamAttenuation=162
downstreamAttenuation=164

b1
[2,0,0,0,0,0]1
ATUCCRCErrors=70
CRCErrors=619
ATUCFECErrors=1305
FECErrors=12809
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0

b1
[3,0,0,0,0,0]1
ATUCCRCErrors=70
CRCErrors=619
ATUCFECErrors=1305
FECErrors=12809
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0

There are a few other bits and pieces scattered through the file such as Up time and the connection details ie my ISP login details... and the firware version stuff, but nothing else of much interest that I can see.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on September 13, 2014, 06:50:39 AM
I'll try to write a small Java program to get the few extra stats that are available via these HTTP POST methods, which should be easier than fiddling about with curl, text files and shell scripts / batch files.

I don't know what's happened to telnet in the latest 9980 firmware, the firmware still contains the telnetd program, which is still started by the main init script. Not that the "cli" program that you're locked into offers much anyway. The reduced_data_model.xml file does have a setting which looks like it enables telnet but the default setting indicates it's enabled, there is also some sort of access control list settings for allowing certain IP addresses access to certain management interfaces. Although just because things are in the reduced_data_model.xml file doesn't actually mean they're in use, e.g. the TD-W8970 has various QoS items in the reduced_data_model.xml and config web pages, for prioritising traffic based on DSCP markings, but they don't work, there's only the bandwidth restrictions.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 13, 2014, 11:52:30 AM
Quote
the firmware still contains the telnetd program, which is still started by the main init script. Not that the "cli" program that you're locked into offers much anyway. The reduced_data_model.xml file does have a setting which looks like it enables telnet but the default setting indicates it's enabled, there is also some sort of access control list settings for allowing certain IP addresses access to certain management interfaces.

Now that is an interesting point.  I mentioned in the other thread that when I first updated the firmware I was able to get telnet access to the CLI.
But now I cant. 


Quote
I'll try to write a small Java program to get the few extra stats that are available via these HTTP POST methods, which should be easier than fiddling about with curl, text files and shell scripts / batch files.

That would be great if you could.  Im sure anyone with the TD-W8970 / TD-W8980 / TD-W9980 would appreciate it :)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 13, 2014, 12:06:51 PM
Quote
Now that is an interesting point.  I mentioned in the other thread that when I first updated the firmware I was able to get telnet access to the CLI.
But now I cant.

Woah...  Im in  :clap:

I thought about what I could have done differently and the only thing I could think was me swapping the ethernet cable from this PC in between the TPLink and the Zyxel.   

I know the diagnostic tool sent to me from TPLink only works via LAN1 so thought Id try swapping ports.  I was on LAN1 from which I cant get access.  Swapped to LAN4  and still no telnet access..   tried from LAN2 LAN3.   success!!!!

Quote
there is also some sort of access control list settings for allowing certain....
Could there actually be anything in there that says eth1 ?

---------
Edited to add.

I was just switching cables without looking at the tiny print underneath which actually says LAN3 - not 2. 
and having just seen this (http://forum.kitz.co.uk/index.php?topic=14429.msg269615#msg269615).  It could be any eth'x' that you may be looking for.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: adslmax on September 13, 2014, 02:11:26 PM
well spot kitz amazing LAN 2 port will work! thanks for let me know. Where did u get diagnostic tool from?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: adslmax on September 13, 2014, 03:42:31 PM
IP="192.168.1.1"
AUTH="YWRtaW46cGFzc3dvcmQ="
curl --data-binary "@td-w8970-adsl-stats-post-all.txt" --referer=http://${IP}/ --header "Cookie: Authorization=Basic ${AUTH}" --header "Content-Type: text/plain; charset=UTF-8" "http://${IP}/cgi?1&5"

Sorry don't understand that bit. How to access it?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on September 13, 2014, 09:01:49 PM
Rename StatPOSTer.zip to StatPOSTer.jar and then you can run it by double clicking it in Windows, or by running "java -jar StatPOSTer.jar" from a command prompt / Linux terminal.

If choosing TD-W9980 for the model doesn't actually work, since I can't test that, then choosing TD-W8970 might work, it'll only be missing things like the VDSL profile value.

If you get a HTTP 500 - Internal Server Error, just click the same button again.

To use the bit for reading or writing settings, you'll need to extract everything in the firmware .bin file with binwalk, and refer to the /etc/reduced_data_model.xml file.

Don't blame me if you break your router using this program. It's called StatPOSTer because it works by making HTTP POST requests, in a similar fashion as the router's own config web pages do.

The few lines of shell script that adslmax quoted above was far less effort to write, and does pretty much the same thing, if you are happy using a command line.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 13, 2014, 10:10:24 PM
It worked first time - thank you :)

Code: [Select]
2014.09.13 22:05:37 xDSL Stats:
[1,0,0,0,0,0]0
status=Up
modulationType=VDSL2
X_TPLINK_CurrSupportLinkType=2
lineEncoding=
allowedProfiles=
currentProfile=
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=20000
downstreamCurrRate=79995
upstreamMaxRate=28383
downstreamMaxRate=82458
upstreamNoiseMargin=98
downstreamNoiseMargin=65
upstreamAttenuation=162
downstreamAttenuation=164
upstreamPower=143
downstreamPower=42
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=265047
showtimeStart=336
quarterHourStart=0
X_TPLINK_Bitswap=On
X_TPLINK_SRA=On
X_TPLINK_AdslModulationCfg=Multimode
X_TPLINK_AnnexType=Annex A/B/L/M
X_TPLINK_SupportAdslMode=VDSL2:A,B,A/B;T1.413:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;Auto Sync-up:A/B/L/M
X_TPLINK_PtmMainIfName=ptm0
[2,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
FECErrors=12961
ATUCFECErrors=1522
HECErrors=0
ATUCHECErrors=0
CRCErrors=624
ATUCCRCErrors=79
[3,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
FECErrors=12961
ATUCFECErrors=1522
HECErrors=0
ATUCHECErrors=0
CRCErrors=624
ATUCCRCErrors=79
[error]0


Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: adslmax on September 13, 2014, 10:46:51 PM
Many thanks ejs - it worked on TD-W9980 and here is mine (24 hours VDSL):

Code: [Select]
2014.09.13 22:45:49 xDSL Stats:
[1,0,0,0,0,0]0
status=Up
modulationType=VDSL2
lineEncoding=
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=19999
downstreamCurrRate=79995
X_TPLINK_AnnexType=Annex A
upstreamMaxRate=33799
downstreamMaxRate=98408
upstreamNoiseMargin=150
downstreamNoiseMargin=114
upstreamAttenuation=127
downstreamAttenuation=113
upstreamPower=124
downstreamPower=2
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=129241
showtimeStart=58
quarterHourStart=0
X_TPLINK_Bitswap=On
X_TPLINK_SRA=On
X_TPLINK_AdslModulationCfg=VDSL2
X_TPLINK_AnnexType=Annex A
X_TPLINK_SupportAdslMode=VDSL2:A,B,A/B;T1.413:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;Auto Sync-up:A/B/L/M
[2,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
FECErrors=2305
ATUCFECErrors=296
HECErrors=0
ATUCHECErrors=0
CRCErrors=123
ATUCCRCErrors=25
[3,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TPLINK_US_ErroredSecs=0
severelyErroredSecs=0
X_TPLINK_US_SeverelyErroredSecs=0
FECErrors=2305
ATUCFECErrors=296
HECErrors=0
ATUCHECErrors=0
CRCErrors=123
ATUCCRCErrors=25
[error]0



One more question how can we tell if VDSL2 become interleaved? (from the stats grabber)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 14, 2014, 12:04:12 AM
One way is the prescense of FEC's, but this doesnt always apply with FTTC, since we are seeing on several lines Forward Error Correction without interleaving.

These are your FECs

Code: [Select]
FECErrors=2305
ATUCFECErrors=296

... but this is the most telling.

Code: [Select]
interleaveDepth=0


Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: adslmax on September 14, 2014, 12:34:09 AM
How many FECErrors in 24 hours before DLM was hit? Was mine 2305 is ok for 24 hours errors?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on September 14, 2014, 07:25:18 AM
While experimenting, I presumably crashed httpd and had to reboot my TD-W8970 to restore access to the web interface. Could still access telnet, but without access to the shell, there's no way to restart the httpd process, so I had to reboot the device.

I was expecting the 2 groups with CRC/FEC/HEC counts to cover different time periods - there are actually 3 groups available, the next version will show all 3, although I won't be surprised if all 3 are exactly the same.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 14, 2014, 11:19:14 AM
Thank you for doing this - your time and effort is appreciated. It's a handy lightweight app that is so much easier than capturing packets to read :)

Yes I'd noticed that the groups on mine were returning data that looked the same.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on September 14, 2014, 06:10:39 PM
New version:
StatPOSTer-20140914.jar (http://ejs1920.users.sourceforge.net/StatPOSTer-20140914.jar)

The new version doesn't need a model list box anymore. It's also much more useful for viewing settings, because if you leave the "key" name blank, the "Get value" or "Get list" buttons will list all the key/value pairs in that object or list.

In terms of viewing the settings, error 9003 is "invalid argument" (all the error codes and messages are in err.js), and often means you need to use "Get list" instead of "Get value" or vice versa. Error 9804 is "object not found" and probably means that the feature for that object was not built into the firmware.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on September 14, 2014, 08:53:33 PM
Thank you ejs.   :)

First time I ran it I got a java error  pop up on my screen.
I then ticked 'Enable settings' and it worked fine.

Ive not been able to re-create the error, but I notice scrolling up

Code: [Select]
2014.09.14 20:43:39 xDSL Stats:
java.io.IOException: Server returned HTTP response code: 500 for URL: http://192.168.1.1/cgi?1&5
2014.09.14 20:43:45 xDSL Stats:

Since everything now appears to be working fine, Im assuming it was just 'one of those things'.


Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: vs1 on September 24, 2014, 02:31:38 AM
Some stats from my faulty line:
Code: [Select]
ActualDataRate: 9.999 Mbit/s 18 Mbit/s
PreviousDataRate: 10 Mbit/s 12.474 Mbit/s
ActualInterleaveDelay: 5 ms 16 ms
ActualImpulseNoiseProtection: 3 sym 10 sym
ActualNetDataRate: 9.999 Mbit/s 18 Mbit/s
ActualImpulseNoiseProtectionRein: 0 sym 0 sym
ActualImpulseNoiseProtectionNoErasure: 3 sym 10 sym
LATN: 18.4 dB 17.6 dB
SATN: 18.3 dB 17.6 dB
SNR: 12.8 dB 22.6 dB
ATTNDR: 22.527437 Mbit/s 79.591552 Mbit/s
ACTPS: -901 -901
ACTATP: 12.0 dBm 5.7 dBm

There is a lot of work to do. There are many stats available and while some are documented most are not. I'm using lantiq source and ECI /r OpenWRT enhanced stats by Kronos_2001 and HighBeta (from the ECI /r thread on here) and also searching the internet for reference. The TP-Link W9980 firmware doesn't have expr or printf but it does have sed:
Code: [Select]
#!/bin/sh

divide() {
local a
local b

let a=$1/$2
let b=$1%$2

echo "$a.$b"
}

remove_trailing_zeros() {
echo "$1" | sed 's/\(\.[0-9]*[1-9]\)0*$/\1/;s/\.0*$//'
}

# Mbit/s
scale_mbit() {
local a
local b

if [ "$1" -gt 1000000 ]; then
let a=$1/1000000
let b=$1%1000000
echo "$(remove_trailing_zeros "$a.$b") Mbit/s"
elif [ "$1" -gt 1000 ]; then
let a=$1/1000
let b=$1%1000
echo "$(remove_trailing_zeros "$a.$b") kbit/s"
else
echo "$1 bit/s"
fi
}

# kbit/s
scale_kbit() {
local a
local b

if [ "$1" -gt 1000 ]; then
let a=$1/1000
let b=$1%1000
echo "$(remove_trailing_zeros "$a.$b") kbit/s"
else
echo "$1 bit/s"
fi
}

stats_cmd() {
echo "$@" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
}

stats_val() {
echo "$1" | sed -n 's/.*'$2'=\([-\.[0-9][0-9]*\).*/\1/p'
}

stats_g997csg() {
local su sd
local vu vd

su=$(stats_cmd g997csg 0 0)
sd=$(stats_cmd g997csg 0 1)

vu=$(stats_val "$su" ActualDataRate)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualDataRate)
[ -z "$vd" ] && vd=0
echo "ActualDataRate: $(scale_mbit $vu) $(scale_mbit $vd)"

vu=$(stats_val "$su" PreviousDataRate)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" PreviousDataRate)
[ -z "$vd" ] && vd=0
echo "PreviousDataRate: $(scale_mbit $vu) $(scale_mbit $vd)"

vu=$(stats_val "$su" ActualInterleaveDelay)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualInterleaveDelay)
[ -z "$vd" ] && vd=0
echo "ActualInterleaveDelay: $(remove_trailing_zeros $(divide $vu 100)) ms $(remove_trailing_zeros $(divide $vd 100)) ms"

vu=$(stats_val "$su" ActualImpulseNoiseProtection)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualImpulseNoiseProtection)
[ -z "$vd" ] && vd=0
echo "ActualImpulseNoiseProtection: $(remove_trailing_zeros $(divide $vu 10)) sym $(remove_trailing_zeros $(divide $vd 10)) sym"

vu=$(stats_val "$su" ActualNetDataRate)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualNetDataRate)
[ -z "$vd" ] && vd=0
echo "ActualNetDataRate: $(scale_mbit $vu) $(scale_mbit $vd)"

vu=$(stats_val "$su" ActualImpulseNoiseProtectionRein)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualImpulseNoiseProtectionRein)
[ -z "$vd" ] && vd=0
echo "ActualImpulseNoiseProtectionRein: $(remove_trailing_zeros $(divide $vu 10)) sym $(remove_trailing_zeros $(divide $vd 10)) sym"

vu=$(stats_val "$su" ActualImpulseNoiseProtectionNoErasure)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ActualImpulseNoiseProtectionNoErasure)
[ -z "$vd" ] && vd=0
echo "ActualImpulseNoiseProtectionNoErasure: $(remove_trailing_zeros $(divide $vu 10)) sym $(remove_trailing_zeros $(divide $vd 10)) sym"
}

stats_g997lsg() {
local su sd
local vu vd

su=$(stats_cmd g997lsg 0 1)
sd=$(stats_cmd g997lsg 1 1)

vu=$(stats_val "$su" LATN)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" LATN)
[ -z "$vd" ] && vd=0
echo "LATN: $(divide $vu 10) dB $(divide $vd 10) dB"

vu=$(stats_val "$su" SATN)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" SATN)
[ -z "$vd" ] && vd=0
echo "SATN: $(divide $vu 10) dB $(divide $vd 10) dB"

vu=$(stats_val "$su" SNR)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" SNR)
[ -z "$vd" ] && vd=0
echo "SNR: $(divide $vu 10) dB $(divide $vd 10) dB"

vu=$(stats_val "$su" ATTNDR)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ATTNDR)
[ -z "$vd" ] && vd=0
echo "ATTNDR: $(scale_mbit $vu) $(scale_mbit $vd)"

vu=$(stats_val "$su" ACTPS)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ACTPS)
[ -z "$vd" ] && vd=0
echo "ACTPS: $vu $vd"

vu=$(stats_val "$su" ACTATP)
[ -z "$vu" ] && vu=0
vd=$(stats_val "$sd" ACTATP)
[ -z "$vd" ] && vd=0
echo "ACTATP: $(divide $vu 10) dBm $(divide $vd 10) dBm"
}

stats_g997csg
stats_g997lsg

To test the script:
Code: [Select]
/tmp # tftp -g -r test.sh 192.168.1.100 && sh test.sh
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on October 09, 2014, 08:20:30 PM
I thought I'd better make a new version to suppress the duplicated stats output. Here it is:
StatPOSTer-20141009.jar (http://ejs1920.users.sourceforge.net/StatPOSTer-20141009.jar)

It turns out that the program might work on any TP-Link modem/router that has a web interface that works the same way.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on October 09, 2014, 09:29:52 PM
Well done ejs.   I cant test it though atm as Im using a different router..  but good work :)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: impossible on February 01, 2015, 08:59:45 AM
Thanks for providing this ejs, I your jar whilst looking for an alternative to HG612_Modem_stats to use with my TPlink 9980.

If you're taking requests, would it be possible for your jar to;

Remember router credentials
run the jar with switches which would provide a file output of the retrieved info with the filename as datetime.txt

I hope to run it on a cron which would record my modem stats over the course of a month etc.


Imp
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on February 01, 2015, 01:36:14 PM
I was not really intending to develop the Java program any further because it seemed very easy to crash the web interface, and the stats available are quite limited. I have been exploring other options but making no progress.

If you can flash the firmware via the serial port, one possibility would be to modify the firmware (http://forum.kitz.co.uk/index.php?topic=13898.msg268200#msg268200), and edit the /etc/init.d/rcS file to contain "telnetd -l /bin/login" instead of just "telnetd". I think the user/pass is root/1234 to login at that level. That would get shell access via telnet, with access to the Lantiq dsl_cpe_control program for full DSL stats.

Otherwise, rather than running a jar file via cron, you could just use small shell script:
Code: [Select]
#!/bin/bash
# script to get more detailed xDSL stats from TP-Link web interface

# standard HTTP basic authentication, but set in cookie
USERNAME="yourusername"
PASSWORD="yourpassword"
AUTH=$(echo -n "${USERNAME}:${PASSWORD}" | base64)

IP="192.168.1.1"

POSTDATA=$'[WAN_DSL_INTF_CFG#1,0,0,0,0,0#0,0,0,0,0,0]0,0\r
[WAN_DSL_INTF_STATS_TOTAL#1,0,0,0,0,0#0,0,0,0,0,0]1,0\r
'

curl \
    --data-binary "${POSTDATA}" \
    --referer "http://${IP}/" \
    --header "Cookie: Authorization=Basic ${AUTH}" \
    --header "Content-Type: text/plain; charset=UTF-8" \
    "http://${IP}/cgi?1&1"
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: impossible on February 01, 2015, 09:38:52 PM
Thanks for the response.

I do currently have serial access, I will give it a bash over the next few days.

Thanks for the suggestion.

Imp

Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on February 15, 2015, 08:49:31 PM
I finally managed to get proper shell access, without opening the case. It was made possible by the person who figured out how to decrypt the saved config file (http://teknoraver.net/software/hacks/tplink/). Standing on the shoulders of that, it was then merely a matter of working out where in the config to tack on a command to start telnet with the right parameters, hoping it gets copied onto a command line and executed, then adjusting the modified config file md5 checksum and padding, re-encrypting the config file, and uploading it. The root user/pass is admin/1234.

Quote
~ # cat /proc/version 
Linux version 2.6.32.32 (swd@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #34 Fri Jun 13 08:36:06 CST 2014

~ # cat /proc/cpuinfo
system type             : VR9
processor               : 0
cpu model               : MIPS 34Kc V5.6
BogoMIPS                : 332.59
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ff8, 0x0ffc, 0x0ffb, 0x0ff8]
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

~ # free
             total         used         free       shared      buffers
Mem:         60888        38280        22608            0         3748
-/+ buffers:              34532        26356
Swap:            0            0            0

~ # dsl_cpe_control --console

DSL_CPE#>vig
nReturn=0 DSL_DriverVersionApi=4.11.4 DSL_ChipSetFWVersion=5.4.4.4.0.1 DSL_ChipSetHWVersion=Unknown DSL_ChipSetType=Lantiq-VRx DSL_DriverVersionMeiBsp=1.2.0 nHybrid=1

DSL_CPE#>lfcg 0
nReturn=0 nDirection=0 bTrellisEnable=1 bBitswapEnable=1 bReTxEnable=0 bVirtualNoiseSupport=0 b20BitSupport=-1

DSL_CPE#>lfcg 1
nReturn=0 nDirection=1 bTrellisEnable=1 bBitswapEnable=1 bReTxEnable=0 bVirtualNoiseSupport=0 b20BitSupport=0
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on February 28, 2015, 08:32:59 AM
I've completed the initial coding to add config file decryption and re-encryption ability to the StatPOSTer program, so I should be able to release a new version within the next few days.

An inconvenience with the trick I'm using to gain shell access is that it gets removed from the config whenever you change any setting. And adding the trick back requires restoring the config file, which requires rebooting the device. And of course TP-Link could stop it working in newer firmware versions.

The TP-Link firmware keeps most processes running even though the relevant feature might be disabled, so there are a few things that could be killed off, depending on what you want to use:
Code: [Select]
killall cwmp
killall dyndns
killall noipdns
killall snmpd
killall ushare

Also the SNMP port appears to be open in the firewall:
Code: [Select]
~ # iptables -L -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           /* loop back */
  294 15488 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    4   168 ACCEPT     all  --  *      *       0.0.0.0/0            224.0.0.0/4         
    0     0 ACCEPT     udp  --  !br+   *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:161
    3   156 ACCEPT     all  --  br+    *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  ppp1   *       0.0.0.0/0            0.0.0.0/0           icmp type 8

Which can be closed:
Code: [Select]
~ # iptables -D INPUT -p udp --dport 161 -j ACCEPT
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on March 01, 2015, 07:12:50 PM
StatPOSTer-20150301.jar (http://ejs1920.users.sourceforge.net/StatPOSTer-20150301.jar)

Latest version fixes a bug with the "Auto" stats setting when encountering the HTTP 500 errors, and adds the config file decryption and encryption functions. The config file decryption automatically removes the MD5 checksum bytes and padding, and the encryption routine calculates the new MD5 checksum and adds the padding, so it might even save myself some time as I won't have to do that manually with a hex editor.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on March 01, 2015, 11:43:22 PM
Excellent progress ejs.   Thank you for sharing your findings with us. :)

Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on March 15, 2015, 09:38:04 PM
Lots of commands, some of the more useful ones:
Code: [Select]
~ # /firmware/dsl_cpe_pipe.sh g997csg 0 0
nReturn=0 nChannel=0 nDirection=0 ActualDataRate=888000 PreviousDataRate=0 ActualInterleaveDelay=25 ActualImpulseNoiseProtection=2

~ # /firmware/dsl_cpe_pipe.sh g997csg 0 1
nReturn=0 nChannel=0 nDirection=1 ActualDataRate=3900000 PreviousDataRate=0 ActualInterleaveDelay=75 ActualImpulseNoiseProtection=12

~ # /firmware/dsl_cpe_pipe.sh g997lsg 0 1
nReturn=0 nDirection=0 nDeltDataType=1 LATN=373 SATN=373 SNR=50 ATTNDR=1100397 ACTPS=0 ACTATP=128

~ # /firmware/dsl_cpe_pipe.sh g997lsg 1 1
nReturn=0 nDirection=1 nDeltDataType=1 LATN=582 SATN=581 SNR=28 ATTNDR=3872000 ACTPS=0 ACTATP=185

~ # /firmware/dsl_cpe_pipe.sh pmcctg 0 0
nReturn=0 nChannel=0 nDirection=0 nElapsedTime=50370 bValid=1 nCodeViolations=455 nFEC=84050

~ # /firmware/dsl_cpe_pipe.sh pmcctg 0 1
nReturn=0 nChannel=0 nDirection=1 nElapsedTime=50370 bValid=1 nCodeViolations=0 nFEC=0

~ # /firmware/dsl_cpe_pipe.sh pmlsctg 0
nReturn=0 nDirection=0 nElapsedTime=50370 bValid=1 nES=323 nSES=0 nLOSS=0 nUAS=58 nLOFS=0

~ # /firmware/dsl_cpe_pipe.sh pmlsctg 1
nReturn=0 nDirection=1 nElapsedTime=50370 bValid=1 nES=0 nSES=0 nLOSS=0 nUAS=58 nLOFS=0

~ # /firmware/dsl_cpe_pipe.sh g997fpsg 0 0
nReturn=0 nChannel=0 nDirection=0 nNFEC=12 nRFEC=12 nLSYMB=240 nINTLVDEPTH=1 nINTLVBLOCK=12 nLPATH=0

~ # /firmware/dsl_cpe_pipe.sh g997fpsg 0 1
nReturn=0 nChannel=0 nDirection=1 nNFEC=10 nRFEC=10 nLSYMB=1058 nINTLVDEPTH=32 nINTLVBLOCK=10 nLPATH=0

Main issue is the CRC and FEC counters always at zero for what I think is the upstream. nDirection=0 obviously is referring to the upstream for some commands, but I looked in the dsl_cpe_control source code which says nDirection=0 means "near end" for pmcctg (PM_ChannelCountersTotalGet).

But the TP-Link layer of the firmware, stats taken at a different time, has given:
Code: [Select]
FECErrors=0
ATUCFECErrors=51965
HECErrors=0
ATUCHECErrors=0
CRCErrors=0
ATUCCRCErrors=312

I can't believe there could possibly have been no CRC or FEC errors on the upstream all day, so I suppose it's just a bug. I've been polling the stats at 10 second intervals, upstream SNR and attainable rate have been constant all day too.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Intikhab on March 31, 2015, 08:46:10 PM
I have adsl router td-w8951nd and today I bought td-w8970. Will it work with 51nd model too? Also haven't yet setup td-8970 v1.2 . should I upgrade it's firmware straight to latest one before trying this kind of injection? I am very interested to use this software  and see how much more I can tweak with my routers and also use 8970 when I get my vdsl connection in future :) but I have no idea how to use the gui of the jar file, err could there be some tutorial or instructions? I am CS student so will learn everything you tell me to? I understand programming but new to this field altogether.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on March 31, 2015, 10:18:11 PM
I should write a guide, I'll try and do it soon.

However:
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Intikhab on April 01, 2015, 04:39:18 AM
I have seen the wiki before coming and it requires a wired serial console connection which I don't have wire or plug to do. Your method don't require any physical connection to maintain at least what I read in this topic I understood.

Will I be okay installing TD-W8970_V1_140613 firmware with bug fixes and not installing further then this? cause in global section it only gives me this and 2 uk firmware. But I am in Pakistan every settings I put in is manual settings, cause no one seems to be using our settings for any kind of quick setup help.

I am trying to understand how you people write things for routers and modem etc. I have only ever wrote things for pc's so far or android phones. Never wrote except for car's OBDII embedded device, it will be a blast learning this :)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: hacktrix2006 on April 01, 2015, 05:03:29 PM
@ejs does this effectively mean the W8980 and W9980 now has root access using your tool?

Just tried to decypt the file conf.bin and it failed on the MD5 hash check, I will be willing to help test this out as i have a serial connection if needed.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on April 01, 2015, 09:44:58 PM
@Intikhab

Apparently older firmware versions allowed custom firmware to be uploaded via the web pages the same way as for original TP-Link firmware, but newer firmware versions stopped that.

@hacktrix2006

I have root shell access on my 8970, but it may not work on other models or newer firmware versions. The config file decryption method was from http://teknoraver.net/software/hacks/tplink/ - perhaps try it manually? I did find the same 8 bytes of the key in the cli program from both 8970-140613 and 9980-141215 firmwares. But I'm not sure if the cli program is even used to backup and restore the config, I wouldn't expect it to be.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Intikhab on April 01, 2015, 10:46:25 PM
just setup the 8970 using quick setup the firmware it is showing is firmware version :0.6.0 2.1 v000c.0 Build 130415 Rel.34164n. hardware version is v1. So will this be considered older version of firmware or never one? not planning to update if it is older one and I might be able to update it to custom one :).

PS. I just decrypt conf.bin after backing up the router settings and it did it the first time though. no idea what to do next. just looking forward to that instructions/tutorial :)
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on April 02, 2015, 07:23:33 AM
130415 is older than 130828 (YYMMDD) mentioned on the OpenWRT wiki, so it would be easier to upload OpenWRT or other customised firmware it you don't update it.

Also, older firmware versions might have given root shell access over telnet anyway, there used to be "enable" and "sh" commands in the TP-Link telnet cli, but not in newer versions.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on April 09, 2015, 09:51:51 PM
Now that I've flashed the 9980 141215 firmware onto my 8970, yes I can see that the saved config file is still scrambled in some way after being decrypted. It looks like the decryption algorithm and key is still the same because you can see readable strings in the decrypted output. But the output is not currently editable.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: L4ky on May 07, 2015, 09:30:21 AM
Hi ejs. I really appreciate you hard work on this.
I have a W8970 build 140613.
The shell is not longer accessible.
I read you unlocked it through the config file, i tried to decrypt but i cannot find any string that is amenable to telnet shell.
Can you help me?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: hacktrix2006 on May 07, 2015, 03:44:16 PM
I think he downloaded the config.bin file from the WebGUI, Then Decrypted it using his TP-Link Stat Grabber and then made the changed there. After that he would of encrypted it and then used the restore config function in the GUI to restore the modded file with the new settings.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on May 07, 2015, 07:06:14 PM
A line needs to be added:
Code: [Select]
<X_TPLINK_DevManufacturerURL val="http://www.tp-link.com`telnetd -p 1023 -l login`" />
It needs to go in the DeviceInfo section, I usually put it immediately before the <X_TPLINK_LogCfg> opening tag.

I think it works because the value stored for X_TPLINK_DevManufacturerURL gets copied into the command line used to start the upnpd process, which is then passed to the shell, and `telnetd -p 1023 -l login` runs a sub-shell to start another telnet process. I used port 1023, but you can pick any port number that's not already in use, the TP-Link telnet cli is still running on port 23. Login user/pass is admin/1234.

Please note: The added line usually gets removed when you change any setting via the web interface. And restoring a newly modified config file to re-apply it requires rebooting the device. So to avoid repeating the process and rebooting it a lot, try to get the general config sorted out as much as possible first.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: L4ky on May 08, 2015, 08:34:40 AM
A line needs to be added:
Code: [Select]
<X_TPLINK_DevManufacturerURL val="http://www.tp-link.com`telnetd -p 1023 -l login`" />
It needs to go in the DeviceInfo section, I usually put it immediately before the <X_TPLINK_LogCfg> opening tag.

I think it works because the value stored for X_TPLINK_DevManufacturerURL gets copied into the command line used to start the upnpd process, which is then passed to the shell, and `telnetd -p 1023 -l login` runs a sub-shell to start another telnet process. I used port 1023, but you can pick any port number that's not already in use, the TP-Link telnet cli is still running on port 23. Login user/pass is admin/1234.

Please note: The added line usually gets removed when you change any setting via the web interface. And restoring a newly modified config file to re-apply it requires rebooting the device. So to avoid repeating the process and rebooting it a lot, try to get the general config sorted out as much as possible first.

I'm not at home now, i'll try it as soon as possible.
Thank you in advance!

Is there any chance to make this mod permanent? Maybe through shell we could make a cron job that at every boot starts a telnet process on a specified port. What do you think?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on May 08, 2015, 07:13:43 PM
The filesystem is readonly, and doesn't contain cron. The system is pretty minimal, it doesn't even have the mv or ln commands (but there is cp and rm). Most of the TP-Link specific firmware functionality is not readily accessible from the busybox shell. The config xml is saved to a separate mtd partition of the flash.

Even if the config addition is removed, the shell access will remain until the device reboots. Making it more permanent would probably require flashing a custom firmware.

The config addition also works if you add Description instead of X_TPLINK_DevManufacturerURL, I can't remember if this is more permanent, I don't think it is, and seeing "300Mbps Wireless N Gigabit ADSL2+ Modem Router`telnetd -p 1023 -l login`" in the web interface looks ugly.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on May 10, 2015, 01:52:21 PM
It appears altering the Description value is less likely to be wiped, but looks ugly in the web interface. I have not yet discovered if adding some HTML code can hide the extra bit from being displayed in the web interface, without the HTML code causing other side effects.
Best I have found so far is:
Code: [Select]
<Description val="&lt;!--`telnetd -p 1023 -l login`--&gt;300Mbps Wireless N Gigabit ADSL2+ Modem Router" />The telnetd part is not visible in the web UI, telnetd is started on port 1023, but it has the side effect that the upnpd process does not get started, so UPnP won't work, although this could be considered a good thing. Probably the semicolons are breaking up the upnpd command line, in the shell you can put multiple commands on one line separated with semicolons.

This is not accepted by the firmware, since the config is stored as XML.
Code: [Select]
<Description val="<!--`telnetd -p 1023 -l login`-->300Mbps Wireless N Gigabit ADSL2+ Modem Router" />
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Mooingall on May 13, 2015, 08:21:55 PM
Neat trick, it just might do as a ghetto startup script (killing junk processes) since everything is read only.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Mooingall on May 20, 2015, 07:07:57 PM
Ejs, do you have a unencrypted config you could share?

Just wanted to have a quick look at whats in it.

Thanks
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on May 20, 2015, 08:26:30 PM
The way the config works, it often doesn't include parts that are unchanged from the defaults (although it does include some stuff, such as 200 empty URLs in the URL filter settings).

The config file structure is described by the reduced_data_model.xml file in the firmware. From the latest 9980 firmware: http://pastebin.com/g7iM2xix (some parts, like the voice telephony, are not supported)

The data model is probably based on TR-098 or some of the other https://www.broadband-forum.org/ "technical reports", other routers (like the Plusnet Sagem 2704N) are also based around the same standards, so have a partly similar xml config file, but with different manufacturer specific parts (things starting with X_TPLINK).

On Linux, the binwalk program can take apart the firmware, and it uses the unsquashfs program to extract the contents of the filesystem. Don't know how well it would work on Windows, but 7-zip can also read some squashfs filesystem images.

The StatPOSTer program can still be used for looking at the settings, although you do have to guess which of "Get value" or "Get list" is appropriate for the specified object.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: Mooingall on May 22, 2015, 02:37:06 PM
Thanks Ejs, I saw both the config template xml files while digging.

I had hoped to see that there would be some extra juicy bits in a decrypted + configured copy.

I had really hoped the FTP server config file was in there, but it seems to be hardcoded in libcmm.so



What did you make of the TFTP stuff within libcmm.so?

There seems to be at least two cases of it being willing to grab some files from a TFTP server and run them. Under what circumstances I don't know.


Code: [Select]
/proc/tplink/wlan_status    open wlan status error! mkdir /tmp/dut  mkdir /tmp/d    tftp -g %s -r dut_images.tar.gz -l /tmp/d/dut_images.tar.gz tftp -g %s -r progmodels.tar.gz -l /tmp/d/progmodels.tar.gz tar -zxf /tmp/d/dut_images.tar.gz -C /tmp/d/    tftp -g %s -r dutserver -l /tmp/dut/dutserver   tftp -g %s -r mtlk.ko -l /tmp/dut/mtlk.ko   chmod +x /tmp/dut/dutserver echo "/tmp/dut/dutserver /tmp/dut/mtlk.ko &" >/tmp/dut/run_dut.sh   chmod +x /tmp/dut/run_dut.sh    /bin/sh /tmp/dut/run_dut.sh tftp -g %s -r art.ko -l /var/tmp/art.ko tftp -g %s -r nart.out -l /var/tmp/nart.out insmod /var/tmp/art.ko  chmod 777 /var/tmp/nart.out /var/tmp/nart.out -console &    hostapd_wlan0
Code: [Select]
/dev/caldata    *********cal_data*******    *********end******* *****DUT has not been calculated! Auto start art!*****  echo 1 > /proc/tplink/eth_forward   arping -I br0 -c 1 192.168.1.100    tftp -g 192.168.1.100 -r art.ko -l /var/tmp/art.ko  tftp -g 192.168.1.100 -r nart.out -l /var/tmp/nart.out  tftp -g 192.168.1.100 -r ScanNart -l /var/tmp/ScanNart  chmod +x /var/tmp/nart.out  /var/tmp/nart.out -instance 1 -console &    chmod +x /var/tmp/ScanNart  /var/tmp/ScanNart & insmod /lib/modules/%s 
Related? http://sekurak.pl/more-information-about-tp-link-backdoor/ Did they just change what triggers this TFTP stuff and call it a day?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on May 22, 2015, 07:21:54 PM
That tftp stuff is related to that backdoor, but there's no obvious way to trigger it anymore. It's probably for testing or calibrating the wifi - dual band devices have two different ones, one for each wifi chip. The cli program contains a reference to a startMFG (and startMFG5G) command, but of course it won't let you run them. It looks like the cli program still contains the sh command too (and always has done previously), it's just been disabled somehow, I don't know if there's some secret way to enable it or if it's just permanently disabled somewhere.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on August 24, 2015, 01:12:35 AM
@ejs

Do you think there is any possibility of getting StatPOSTer to work with the Archer VR900.   

Ive been playing tonight but all I get is java.io.IOException: Server returned HTTP response code: 500 (http://www.hccp.org/java-net-cookie-how-to.html) for URL: http://192.168.1.1/cgi?1&5

Ive just spent several unsuccessful hours attempting to get binwalk running on a windows system, the site says it may work but I just cant seem to get python to accept and install it to run as a script. 
There are no real set up instructions for Win other than the author saying this (https://twitter.com/devttys0/status/591452273156456448) :/   
Searching seems to bring up the one same user asking for help getting it installed on Windows, but no answers.

I think you said you have binwalk and if so the f/w can be downloaded here (http://www.tp-link.com/en/download/Archer-VR900_V1.html#Firmware).  If there's any more info you need from me, just yell.

tyvm
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on August 24, 2015, 10:18:15 AM
It may be possible, parts of the TP-Link web interface seem fairly similar. I unpacked the firmware with binwalk, most of the TP-Link stuff is in the part built for the ARM cpu architecture. The /etc/default_config.xml and /etc/reduced_data_model.xml files are encrypted, it's probably possible to find the decryption key somewhere in the firmware, but I don't really know where. The key used on the saved config files was in the cli program in older models, and although I did find some bytes that looked similar in a similar place in the cli program in the VR900 fw, I have not yet succeeded in decrypting those files.

I think X_TPLINK_ has been shortened to X_TP_ in places but that shouldn't matter.

The StatPOSTer program mostly works by emulating the web interface. In previous models, you could see some extra information just be looking in wireshark or in Firefox Network Developer Tools (see screenshot).

When you login to the VR900 web interface, does it ask for a username and password, or just a password?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on August 24, 2015, 05:57:26 PM
Quote
In previous models, you could see some extra information just be looking in wireshark

Sorry, my fault I forgot to mention that.  I tried it several days ago and yes it is giving some additional info, which is why I wondered if it would work with StatPOSTer

This is part of the info that I managed to get about a week ago or so agao.   Im not sure if the ErrSec counter is really zero though as its now been on during some several heavy storms and when I tried again last night it was still showing as zero.   Anyways this shows there is a bit more there.
Code: [Select]
129
[1,0,0,0,0,0]0
status=Up
modulationType=VDSL2
X_TP_AdslModulationCfg=Multimode
upstreamCurrRate=20000
downstreamCurrRate=79987
X_TP_AnnexType=Annex A/L/M
upstreamMaxRate=30203
downstreamMaxRate=80125
upstreamNoiseMargin=127
downstreamNoiseMargin=63
upstreamAttenuation=0
downstreamAttenuation=177

a2
[2,0,0,0,0,0]1
ATUCCRCErrors=0
CRCErrors=166
ATUCFECErrors=15
FECErrors=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
erroredSecs=0
X_TP_US_ErroredSecs=0

a2
[3,0,0,0,0,0]1
ATUCCRCErrors=0
CRCErrors=166
ATUCFECErrors=15
FECErrors=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
erroredSecs=0
X_TP_US_ErroredSecs=0

8
[error]0
0

Quote
When you login to the VR900 web interface,

Just the password
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on August 24, 2015, 08:04:07 PM
Hopefully it's as simple as the user:pass is incorrect, I looked at the source of /web/frame/login.htm and it appears to only use the password.

New version allows for an empty username field, which I think is what's needed:
StatPOSTer-20150824.jar (https://drive.google.com/open?id=0B-a1g-fTQhGmaENNMXhLOTE5bTg) or here (http://ejs1920.users.sourceforge.net/StatPOSTer-20150824.jar)

The error seconds items probably never get filled in.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on August 24, 2015, 09:20:03 PM
Excellent work that man!  :yay:

Code: [Select]
[1,0,0,0,0,0]0
enable=1
status=Up
linkEncapsulationRequested=
linkEncapsulationUsed=G.993.2_Annex_K_PTM
modulationType=VDSL2
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=17a
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=1
X_TP_VDSLProfiles_US0_8a=1
dataPath=Fast
interleaveDepth=0
lineNumber=0
upstreamCurrRate=20000
downstreamCurrRate=79987
upstreamMaxRate=30409
downstreamMaxRate=79986
upstreamNoiseMargin=129
downstreamNoiseMargin=63
upstreamAttenuation=0
downstreamAttenuation=177
upstreamPower=63
downstreamPower=143
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=95873
showtimeStart=1390671
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=On
X_TP_AdslModulationCfg=Multimode
X_TP_AnnexType=Annex A/L/M
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A/L/M
[2,0,0,0,0,0]0
enable=0
status=Disabled
linkEncapsulationRequested=
linkEncapsulationUsed=G.992.3_Annex_K_ATM
modulationType=
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=1
X_TP_VDSLProfiles_US0_8a=1
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=0
downstreamCurrRate=0
upstreamMaxRate=0
downstreamMaxRate=0
upstreamNoiseMargin=0
downstreamNoiseMargin=0
upstreamAttenuation=0
downstreamAttenuation=0
upstreamPower=0
downstreamPower=0
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=0
showtimeStart=0
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=On
X_TP_AdslModulationCfg=Multimode
X_TP_AnnexType=Annex A/L/M
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A/L/M
[3,0,0,0,0,0]0
enable=0
status=Disabled
linkEncapsulationRequested=
linkEncapsulationUsed=G.992.3_Annex_K_ATM
modulationType=
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=1
X_TP_VDSLProfiles_US0_8a=1
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=0
downstreamCurrRate=0
upstreamMaxRate=0
downstreamMaxRate=0
upstreamNoiseMargin=0
downstreamNoiseMargin=0
upstreamAttenuation=0
downstreamAttenuation=0
upstreamPower=0
downstreamPower=0
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=0
showtimeStart=0
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=On
X_TP_AdslModulationCfg=Multimode
X_TP_AnnexType=Annex A/L/M
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A/L/M
[1,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TP_US_ErroredSecs=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
FECErrors=0
ATUCFECErrors=308
HECErrors=2983
ATUCHECErrors=0
CRCErrors=2541
ATUCCRCErrors=40
[2,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TP_US_ErroredSecs=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
FECErrors=0
ATUCFECErrors=308
HECErrors=2983
ATUCHECErrors=0
CRCErrors=2541
ATUCCRCErrors=40
[3,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TP_US_ErroredSecs=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
FECErrors=0
ATUCFECErrors=308
HECErrors=2983
ATUCHECErrors=0
CRCErrors=2541
ATUCCRCErrors=40
[error]0


Quote
he error seconds items probably never get filled in.
I suspect so too, as per upstream attenuation.

Interesting the duplication of some data fields which are empty.  Possible different channels/bearers?
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: ejs on August 24, 2015, 09:37:48 PM
Thank you. I'm not sure why there are 3 sets of each block of values. I assumed the blocks with CRC and FEC would be for different time intervals, such as all time, 15 mins or 1 day. But it's just 3 sets of duplicate information. I think the general tree structure, and the names (that don't begin with X_TP) are all based around the TR-098 standard.
Title: Re: Getting extra DSL stats from TP-Link TD-W8970
Post by: kitz on August 31, 2015, 10:07:03 PM
Pinning this because I can never find it when I want.

Ive also changed the topic title slightly because it now applies to other models.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: frakitz on October 19, 2015, 10:02:15 PM
Hello everybody!

Did anyone manage to tweak the SNR value on a TD-W8970v1?

Thank you!
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on October 20, 2015, 05:55:40 AM
I have not attempted to do it, but it should be possible with shell access (http://forum.kitz.co.uk/index.php/topic,15738.0.html). Getting shell access on the 8970v1 is easier than the 9980 because the saved config files are not compressed, so you can decrypt, edit, encrypt and upload.

The dsl_cpe_pipe command to try and adjust the target downstream noise margin is:

locs 0 x

where x is a value from -50 to 50 corresponding to -5.0 dB to 5.0 dB e.g.

locs 0 20

would increase the target SNRM by 2 dB

The comment in src/include/drv_dsl_cpe_api.h above DSL_OPT_NOISE_MARGIN_DELTA_DS says
Quote
If this parameter will be changed from it's default value it is
strictly recommended to use ONLY positive values. Negative values
are likely to result in link instabilities.

dsl_cpe_pipe being /firmware/dsl_cpe_pipe.sh in TP-Link firmware.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: frakitz on October 20, 2015, 08:49:24 AM
Thanks for your reply.

I got shell access and run those commands without success.
I also forced ADSL resync with
 acs 2

but the SNR value is unaltered.

Since I got shell access is it possible to install another firmware (e.g. OpenWRT) which allows tweaking the SNR value, without opening the router and soldering?
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on October 20, 2015, 01:08:14 PM
It's probably possible to flash a new firmware from the shell, but I don't know how, plus you might want to build your own OpenWRT firmware with various updated lantiq components if applicable.

One part of the sources says this about the locs command:
Quote from: src/include/drv_dsl_cpe_api_ioctl.h
- Supported by ADSL only platforms (XWAY(TM) ARX100, XWAY(TM) ARX300)

But the ChangeLog contains:
Quote
V4.15.1 - 2013-07-18
...
- VRX (DSLCPE_SW-732) Include/rework implementation for NoiseMargingDelta
  configuration.

So I'm not sure if the locs command works on the VRX268 or not.

Another possibility would be to install the 9980 firmware, although this does make getting shell access slightly more difficult, it's not too bad because all the settings get wiped anyway when flashing the 9980 firmware.

8970v1 firmware contains Lantiq DSL driver 4.11.4
9980 firmware contains Lantiq DSL driver 4.16.6 and newer DSL firmware

The end of the crossflashing thread (http://forum.kitz.co.uk/index.php/topic,14461.msg296659.html#msg296659) has 2 different methods for uploading a firmware image for a different model via the web interface.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: frakitz on October 20, 2015, 02:39:49 PM
Very interesting.

I'll try to use the TD-W9980 firmware.
Is the latest version ok? (May 2015)

Thank you.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on October 20, 2015, 04:04:54 PM
I've put the 9980 150507 firmware on my 8970, I expect it would work, but I am not really using it currently, it's sat on a shelf and occasionally switched on and used as a network switch.

Code: [Select]
# /firmware/dsl_cpe_pipe.sh vig
nReturn=0 DSL_DriverVersionApi=4.16.6-pd1pa1 DSL_ChipSetFWVersion=5.7.1.8.0.1 DSL_ChipSetHWVersion=Unknown DSL_ChipSetType=Lantiq-VRX200 DSL_DriverVersionMeiBsp=1.4.4 nHybrid=1

~ # /firmware/dsl_cpe_pipe.sh locs 0 -10
nReturn=20

~ # /firmware/dsl_cpe_pipe.sh locs 1 1
nReturn=-11
~ # /firmware/dsl_cpe_pipe.sh locg 0
nReturn=0 nConfigValue=-10

~ # /firmware/dsl_cpe_pipe.sh locg 1
nReturn=-11

locs / locg options 0 and 4 appear to be valid (4 is ADSL2/2+ enhanced US framing, enabled by default), options 1, 2 and 3 give that nReturn=-11, negative return values indicate an error.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: frakitz on October 20, 2015, 06:38:14 PM
It seems to be working!

Thank you very much!
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: kitzuser87430 on February 21, 2016, 12:22:52 PM
JUst bought a tp-link w9970 modem/router with a broadcom chipset.

Using ejs' StatPOSTer-20150824.jar I can get (same as other tp-link routers) some stats but I cannot decrypt the config.bin configuration file from the GUI to try the addition to the config file as described here http://forum.kitz.co.uk/index.php/topic,14377.msg287247.html#msg287247 (http://forum.kitz.co.uk/index.php/topic,14377.msg287247.html#msg287247)

I presume the key has changed from this method http://teknoraver.net/software/hacks/tplink/ (http://teknoraver.net/software/hacks/tplink/)

Any ideas how to find the 8 byte key for this model and firmware?
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on February 21, 2016, 01:29:34 PM
The bytes of the key used to encrypt the config file can be found by disassembling the cli binary. Of course it's much easier to find them if you already know what they are. The key appears to be the same for the TD-W9970.

The StatPOSTer program should save the decrypted file, but you will not be able to edit the file, because it is compressed. If you examine the decrypted file in a hex editor, you might see a few readable parts of the config file near the start of the file, but there are less readable parts further down the file. I do not know how to decompress the data, nor how to compress it again.

It might be possible to adapt the strategy used with the TD-W9980, but the first problem is that I don't have a blank editable xml config for the 9970, and the second problem is that there may have been some slight changes to the file format, the MD5 checksum at the start might be for the compressed data, rather than the uncompressed data like it is for the older models.

In summary, it might be possible to work out how to do it, but it requires some original research by someone who has the device and is willing to do a lot of experimenting with it, while it's not connected to the phone line of course, because it may require a lot of rebooting. It's also possible that if you upload a config file with somehow bad contents, the device may accept it, load it, and reboot, but the device may not function and requires pressing the factory reset button. The minimum tools needed would be a hex editor, an md5sum program, and some program like the openssl command that can do the encryption (can't use StatPOSTer because it adds or removes the MD5 checksum automatically).

If you send me a sample config file (with no personal data in - factory reset the 9970 first), I could look at it, but even if I could figure out how to adapt the method used with the 9980, which there is no guarantee I could do, or even that the strategy used with the 9980 can be applied, there would still be the problem of the blank editable config file needed.

I know there's a default_config.xml file in the firmware, but that's also encrypted on newer models, and I haven't found how to decrypt it yet, and in any case, that default_config.xml file is nothing like the config saved by the device, so even if someone finds the key and how to decrypt it, it's doubtful it could be used anyway.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: kitzuser87430 on February 21, 2016, 08:17:56 PM
Thanks ejs...i will disconnect sometime this week, and use another modem; i will then reset and post a default config on a new thread.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: kitzuser87430 on February 25, 2016, 11:12:04 AM
I have now reset and uploaded the default conf.bin.

http://forum.kitz.co.uk/index.php/topic,17108.0.html (http://forum.kitz.co.uk/index.php/topic,17108.0.html)

Ian
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: kitz on March 13, 2016, 09:59:03 PM
Update from ejs

The latest version of the StatPOSTer program is 20160306
http://ejs1920.users.sourceforge.net/StatPOSTer-20160306.jar

The new version has a choice of devices to target when encrypting a config file:
TD-W8970v1
TD-W9970 (as tested here (http://forum.kitz.co.uk/index.php/topic,17108.0.html))
TD-W9980
VR900 (untested)
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: andyb2000 on December 12, 2016, 03:13:27 PM
I'm trying to get some basic stats (including serial number) from my TD-W9970 and struggling, so I'm hoping it's something silly I'm doing that can be solved easily.

I'm using the following to try and retrieve the same info as the StatPOSTer java app, as I want to do this via shell scripts so using curl is a must. The command I'm using is:

Code: [Select]
curl -X POST -d '[IGD_DEV_INFO#0,0,0,0,0,0#0,0,0,0,0,0]0,0' --referer http://192.168.1.1/ --header "Cookie: Authorization=Basic `echo -n admin:admin | base64`" --header "Content-Type: text/plain; charset=UTF-8" "http://192.168.1.1/cgi?1&1"
But this constantly just returns "[error]71111"

I've tried several ways of providing the post data/binary, including it in a file and not, but none work, they all return the same. Using the statposter.jar it works fine, I can query "IGD_DEV_INFO" it returns the info I'm looking for.
Wireshark shows the post payload as:

Code: [Select]
[IGD_DEV_INFO#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n
Which I've tried in the post data and data file without luck, can anyone spot the stupid mistake I'm making please?

Thanks!
Andy
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on December 12, 2016, 04:59:02 PM
The URL is incorrect but that doesn't actually matter, and the -X POST is unnecessary because curl automatically does a POST request if you specify -d.

The main trouble is with putting in the carriage return and new line characters into the data.

This should work:

Code: [Select]
curl -d $'[IGD_DEV_INFO#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n' --referer http://192.168.1.1/ --header "Cookie: Authorization=Basic `echo -n admin:admin | base64`" --header "Content-Type: text/plain; charset=UTF-8" "http://192.168.1.1/cgi?1"
I abandoned doing anything with the TP-Link HTTP POST interface in favour of gaining proper telnet access.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: andyb2000 on December 13, 2016, 09:08:20 AM
Ahh! Thank you so much ejs, something so silly I'd missed it :-)

Working great now, thank you.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: adslmax on February 05, 2017, 08:11:30 PM
Is there any chance of StatPOSTer program to work with TP Link VR600 please?

getting error:

2017.02.05 20:10:39 xDSL Stats (1st,Auto):
java.io.IOException: Server returned HTTP response code: 500 for URL: http://192.168.1.1/cgi?1&5
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on February 05, 2017, 08:32:29 PM
It often gives that error the first time, just try again.

Really though, the stats available using that method are limited and it's fairly unreliable, so that aspect of the program is deprecated. The program's main useful function now is for generating config files for gaining proper shell access. The CPU architecture of the VR600 is the same as the 9970, so the config file formatting might be the same.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: adslmax on February 05, 2017, 08:57:18 PM
Still not working?
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: burakkucat on February 05, 2017, 09:15:32 PM
Does the VR600 require you to enter a user name when logging in?  :-\

If no, just set the string in the "User name" box to null and try again.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: adslmax on February 05, 2017, 09:26:37 PM
Bingo it working now. :)

The username have to be blank.

Code: [Select]
2017.02.05 21:24:08 xDSL Stats (1st,Auto):
[1,0,0,0,0,0]0
enable=1
status=Up
linkEncapsulationRequested=
linkEncapsulationUsed=G.993.2_Annex_K_PTM
modulationType=VDSL2
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=17a
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=0
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=19999
downstreamCurrRate=79999
upstreamMaxRate=28725
downstreamMaxRate=86088
upstreamNoiseMargin=151
downstreamNoiseMargin=67
upstreamAttenuation=128
downstreamAttenuation=68
upstreamPower=-2
downstreamPower=124
usNegBandPlanDiscPresentation=3
dsNegBandPlanDiscPresentation=3
SATNus=30,119,194,1023,1023
SATNds=88,151,247,1023,1023
LATNus=30,128,203,1023,1023
LATNds=68,152,247,1023,1023
SNRMarginus=152,151,151,-512,-512
SNRMarginds=68,66,68,-512,-512
transmitPowerUs=-153,-305,-4,-1281,-1281
transmitPowerDs=79,77,72,-1281,-1281
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=14915
showtimeStart=14895
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=Off
X_TP_AdslModulationCfg=VDSL2
X_TP_AnnexType=Annex A
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.lite:A;G.dmt:A;ADSL2:A,A/L;ADSL2+:A,M,A/L/M;Auto Sync-up:A,A/L,M,A/L/M
[1,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TP_US_ErroredSecs=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
FECErrors=525
ATUCFECErrors=87
HECErrors=0
ATUCHECErrors=0
CRCErrors=0
ATUCCRCErrors=22
ATUCSeverelyErroredSecs=0
[error]0

Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: burakkucat on February 05, 2017, 09:39:21 PM
Bingo it working now. :)

The username have to be blank.

Thanks for confirming, Max. I could not remember if those TP-Link devices' GUI require a user name or not.  ;)
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: simoncraddock on July 23, 2017, 06:38:23 PM
Thanks for this.

I can verify this working on the TP-Link VR2600 also.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: Bestgear on August 10, 2017, 04:29:33 PM
Guys

Sorry for being Mr Thickie here....

I have a V1 9970, and I can telnet into the box on lan port 1 on port 22. I have not applied any tweeks - and its running the latest (OEM) firmware.

Do I still need the "just telnet"?

I thought the issue, having read the threads was that telnet was disabled as standard, yet on mine its not.

Lastly, in DSLSTATS - what should teh modem/router be set to? - I had read somewhere that it works as a HG635?

Many thanks for your help.

David
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: roseway on August 10, 2017, 06:34:39 PM
I'm not very familiar with this model, but I believe that the telnet interface takes you to a custom CLI which only has limited capabilities. I may be wrong though.

In DSLstats it really makes no difference what the modem/router is set to. This is only a convenient way of setting up the default configuration for each model it recognises. All you actually need to do is fill in the details to suit your particular modem.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: Dink on August 23, 2017, 04:46:36 PM
Hi all ,

Has anyone sussed a way to get " Real Telnet " working on a VR900 yet or more access to Broadcom CLI ?

I have Statposter working perfect  , thanks ejs for your time sussing that out .

If yes are there any instructions to follow yet ?

I have noticed that the GUI in the VR900 v2 ( and probably most of the VR's it seems ) shows errors on the Upload but always 0 on Download , these Errors are from the " ATUC CRC Errors " looking at Statposter but the CRC Errors for Down are always 0 , same as GUI .

These are the Line Statistics I was getting the other week ( Errors now on Upstream are 1784 ) , I know this isn't too bad
but its really annoying not being able to even see if I'm on Interleave or Fastpath , or even if my line is deteriorating until I see a
major drop in Link Speed , or a massive hike in ping times.

I have had Major headaches getting my connection fixed over the last few months , it started with connection drops , Interleave
going up over 3000 , pings of 50/100 ms and Link Speed dropping to 50 on Downloads.

I now have a new drop line and a MK4 Master box and all seems good , I am only 250 metres from my cabinet that sits outside my local exchange so I knew there was problems and with my Huawei HG633 I could at least see some info , the VR900v2 is working fantastic compared to the HG633 but I would love to keep an eye on my connection for reference in the future , should I need it .

I now get 75 down and 19 up with 5-20 ms pings and want to keep it that way  ;)

--------------------------------------------------------------------------------
Welcome To Use TP-LINK COMMAND-LINE Interface Model.
--------------------------------------------------------------------------------
TP-LINK(conf)#adsl show info

INDEX=1
{
enable=1
status=Up
linkEncapsulationRequested=
linkEncapsulationUsed=G.993.2_Annex_K_PTM
modulationType=VDSL2
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=17a
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=0
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=19999
downstreamCurrRate=79999
upstreamMaxRate=34537
downstreamMaxRate=95011
upstreamNoiseMargin=155
downstreamNoiseMargin=94
upstreamAttenuation=138
downstreamAttenuation=63
upstreamPower=-2
downstreamPower=139
usNegBandPlanDiscPresentation=3
dsNegBandPlanDiscPresentation=3
SATNus=47,134,191,1023,1023
SATNds=69,146,245,1023,1023
LATNus=47,138,200,1023,1023
LATNds=63,147,245,1023,1023
SNRMarginus=155,153,156,-512,-512
SNRMarginds=94,94,93,-512,-512
transmitPowerUs=-146,-296,-4,-1281,-1281
transmitPowerDs=114,79,68,-1281,-1281
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=6532
showtimeStart=4383
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=On
X_TP_AdslModulationCfg=VDSL2
X_TP_AnnexType=Annex A
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.lite:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,
A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A/L/M
}
cmd:SUCC
TP-LINK(conf)#

StatPoster output

2017.08.02 13:56:25 xDSL Stats (1st,Auto):
[1,0,0,0,0,0]0
enable=1
status=Up
linkEncapsulationRequested=
linkEncapsulationUsed=G.993.2_Annex_K_PTM
modulationType=VDSL2
lineEncoding=
allowedProfiles=8a,8b,8c,8d,12a,12b,17a,30a
currentProfile=17a
X_TP_VDSLProfiles_8a=1
X_TP_VDSLProfiles_8b=1
X_TP_VDSLProfiles_8c=1
X_TP_VDSLProfiles_8d=1
X_TP_VDSLProfiles_12a=1
X_TP_VDSLProfiles_12b=1
X_TP_VDSLProfiles_17a=1
X_TP_VDSLProfiles_30a=0
dataPath=
interleaveDepth=0
lineNumber=0
upstreamCurrRate=19999
downstreamCurrRate=79999
upstreamMaxRate=34545
downstreamMaxRate=95027
upstreamNoiseMargin=155
downstreamNoiseMargin=93
upstreamAttenuation=138
downstreamAttenuation=63
upstreamPower=-2
downstreamPower=139
usNegBandPlanDiscPresentation=3
dsNegBandPlanDiscPresentation=3
SATNus=47,134,191,1023,1023
SATNds=69,146,245,1023,1023
LATNus=47,138,200,1023,1023
LATNds=63,147,245,1023,1023
SNRMarginus=155,153,156,-512,-512
SNRMarginds=94,93,93,-512,-512
transmitPowerUs=-146,-296,-4,-1281,-1281
transmitPowerDs=114,79,68,-1281,-1281
ATURVendor=
ATURCountry=
ATUCVendor=
ATUCCountry=
totalStart=4656
showtimeStart=2507
quarterHourStart=0
X_TP_Bitswap=On
X_TP_SRA=On
X_TP_AdslModulationCfg=VDSL2
X_TP_AnnexType=Annex A
X_TP_SupportAdslMode=VDSL2:A;T1.413:A;G.lite:A;G.dmt:A;ADSL2:A,A/L/M;ADSL2+:A,M,A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A/L/M
[1,0,0,0,0,0]1
receiveBlocks=0
transmitBlocks=0
cellDelin=0
linkRetrain=0
initErrors=0
initTimeouts=0
lossOfFraming=0
erroredSecs=0
X_TP_US_ErroredSecs=0
severelyErroredSecs=0
X_TP_US_SeverelyErroredSecs=0
FECErrors=56
ATUCFECErrors=8
HECErrors=0
ATUCHECErrors=0
CRCErrors=0
ATUCCRCErrors=3
ATUCSeverelyErroredSecs=0
[error]0


Have been a covert follower of this forum for many years , thanks Kitz ( and many others ) for your time and effort keeping it running smooth,
it has helped me so many times answering difficult questions or simply as somewhere to access hard to find info like the awesome reference pages on Road Side cabinet manufacturers and what the different types of errors are and what they mean , kitz is probably one of the best places on the Internet that I have found for Broadband stuff , its compiled Library of Information is astounding .
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on August 23, 2017, 06:54:28 PM
You could attempt the same procedure as has been done with the TD-W9970, use RouterPassView to obtain the editable content of your saved config file, add the line for proper telnet access, and use StatPOSTer to make a config file suitable for uploading to the VR900. An option in the StatPOSTer model list was added for the VR900 at the same time as the others, but it was never tested.

If you are going to experiment with your VR900, it would probably be best to do it with the VR900 disconnected from the phone line, because uploading a config file makes it reboot, and it may take many attempts to get it working, and you wouldn't want the DLM to see all those disconnections and reduced your speed.
Title: Getting extra DSL stats from TP-Link modem/routers
Post by: Dink on August 23, 2017, 08:37:40 PM
Hi ejs,

Thanks for getting back so quick ,

Sounds like I need to do some more reading regards the "RouterPassView" bit .

I shall re read this from page 1 and take better note of whats being said , I take it all the answers are here in this thread .

Loading a dodgy config file at worst means I need to do a full reset , and then reload a good config file ?

When I start tinkering I will remove DSL cable till I get it sussed , don't want to upset the DLM god . :-X

Maybe a bit before I can , as work is hectic and I need to guarantee kids aren't about as they seem to not be able
to survive without Interent for a few hours , lol , but will post back on here with my results when I do .

I may be back for enlightenment if I get confused if that's ok.

Dave.


Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: Dink on September 12, 2017, 11:27:49 PM
Hi ejs,

Had some free time tonight so thought I'd have a play ,followed the  " JohnDoe " explanation :

1. login to the web gui => http://192.168.1.1
2. backup your current configuration => current-conf.bin
3. download this tool => http://www.nirsoft.net/utils/router_password_recovery.html
4. launch RouterPassView.exe (not tested with wine under linux) and open your router config file (ctrl + o) => current-conf.bin
5. go to the options menu and change settings (f3) => text mode - ascii
6. copy your current xml configuration (ctrl + a / ctrl + c) and save it in a new file (ctrl + v) => current-conf.xml
7. insert the description line tweak with telnetd into your xml (see above)
8. launch StatPOSTer-test3.jar, select "TD-W9970" and encrypt your xml file to get the new binary config file => current-conf-with-telnetd.bin
9. login to the web gui => http://192.168.1.1 and to enable telnetd, use the restore option with this file  => current-conf-with-telnetd.bin

Opened conf.bin with RouterPassView , did a copy/paste into notepad++ , added the telnetd line ,saved, then used StatPoster to Encrypt the file , re opened the new conf.bin with RouterPassview and all looks good and ready to test.

However the conf.bin started at 7KB and now its 47KB is this normal , or has it not compressed/encrypted correctly ?

Or does this not matter , if so I will have a go at uploading it and post results ?

Dave.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on September 13, 2017, 06:29:03 PM
It's normal that the current-conf-with-telnetd.bin will be much larger than the original current-conf.bin, in fact it will be larger than the edited current-conf.xml. It's because it has not actually been compressed, because I have not been able to reverse engineer the compression/decompression algorithm. The StatPOSTer program merely formats the contents of the file so that the router will accept it. It's not a problem unless the file ends up too big for the router to accept, some models may have limits for the maximum size of the config file.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: Dink on September 13, 2017, 10:47:57 PM
Hi ejs,

Thanks for getting back to me , I did go and look at some of the other files for the TD-W9970 and they also
seemed to have grown after playing with them so assumed maybe a compression issue , but wanted to make
sure I wasn't making a silly mistake  ;)

Will post up here as soon as I have had a chance to upload the config file , with some screen shots etc.

Dave.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: siofjofj on October 22, 2017, 02:39:57 PM
Hi all,

Some brilliant work here ejs, and thanks Dink for your JohnDoe explanation.
I've managed to get proper telnet access, and hence DSLstats, working on the TP-Link VR600 v1. I've also managed to get the Dynamic DNS client in the router to work with DuckDNS (a really nice free dynamic DNS service) by editing the configuration file. The procedures used on my VR600 v1 with 160614 firmware are:

To edit configuration file:
1) Download config file from router in web interface.
2) Open config file using routerpassview  (http://www.nirsoft.net/utils/router_password_recovery.html). Working fine under linux with wine 1.6.2
3) Copy contents (ASCII text) to a text file and save as somthing.xml
4) Edit as required (see below).
6) Use StatPOSTer-20160306.jar (http://ejs1920.users.sourceforge.net/StatPOSTer-20160306.jar) to encrypt using TD-W9970 model.
7) Upload resulting bin.

To enable proper telnet:
1) Download config as above.
2) Add <Description val="http://www.tp-link.com`telnetd -p 1023 -l login`" /> between <DeviceInfo> and </DeviceInfo>. This will look like the below:
Code: [Select]
    <DeviceInfo>
      <ManufacturerOUI val=BLAH />
      <SerialNumber val=SERIAL />
      <HardwareVersion val="Archer VR600 v1 00000000" />
      <SoftwareVersion val="0.2.0 0.9.1 v0057.0 Build 160614 Rel.41735n" />
      <UpTime val=12 />
      <X_TP_IsFD val=3 />
      <Description val="http://www.tp-link.com`telnetd -p 1023 -l login`" />
    </DeviceInfo>
3) Install config as above.
4) Telnet should now be available using "telnet [IP] 1023" under linux. User=admin, Password=1234
5) DSLstats is pretty much set up right by selecting Zyxel VMG8924-B10A, just change Telnet port to 1023.
Note: For this router, using the Description does not make a mess of the web interface as this field is not displayed. The change is also not lost with configuration changes.

To enable DuckDNS for domain DOMAIN.duckdns.org with token TOKEN (token available from main DuckDNS account page):
1) On dynamic DNS settings page (Advanced > Network > Dynamic DNS) of the webgui:
Select Dyndns
Username = DOMAIN
password = TOKEN
Domain Name = DOMAIN
2) Press Save, then Log in. This will throw an authentication error.
3) Download router config and proceed as above.
4) In the <DynDnsCfg> section of the config, change Server from members.dyndns.org to www.duckdns.org. This should look like the below:
Code: [Select]
      <DynDnsCfg>
        <Enable val=1 />
        <UserName val=DOMAIN />
        <Password val=TOKEN />
        <UserDomain val=DOMAIN />
        <Server val=www.duckdns.org />
      </DynDnsCfg>
5) Install config as above.
6) Back in the Dyanmic DNS page of the web interface press Log in. You should now get success!

Cheers
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: burakkucat on October 22, 2017, 06:44:45 PM
Welcome to the Kitz forum.  :)

And "thank you" for posting a clear description of the steps you took to achieve success with a TP-Link VR600 v1 modem/router.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: fergie on December 05, 2017, 10:28:36 AM
Thanks all for the info!

Followed instructions and managed to get this working on my new TP-Link Archer VR2800  :)
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: adslmax on December 05, 2017, 10:33:19 AM
Thanks all for the info!

Followed instructions and managed to get this working on my new TP-Link Archer VR2800  :)

Does your new tp link vr2800 have connection time stamp on it? Because my tp link vr2600 doesn't have any connection time stamp nor system up time stamp.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: fergie on December 05, 2017, 11:02:12 AM
Does your new tp link vr2800 have connection time stamp on it? Because my tp link vr2600 doesn't have any connection time stamp nor system up time stamp.

Hi adslmax, are you asking about stats from StatPOSTer?  As I didn't get that to work and only used it to encrypt my config file.

I get the following in DSLstats, which includes an uptime:

Code: [Select]
Stats recorded 05 Dec 2017 10:56:46

DSLAM/MSAN type:        BDCM:0xb12d / v0xb12d
Modem/router firmware:  AnnexA version - A2pvbH042j2.d26m
DSL mode:                VDSL2 Profile 17a
Status:                  Showtime
Uptime:                  10 hours 15 min 2 sec
Resyncs:                0 (since 05 Dec 2017 00:48:12)

Downstream Upstream
Line attenuation (dB):  12.3 0.0
Signal attenuation (dB): Not monitored
Connection speed (kbps): 14995 11999
SNR margin (dB):        25.7 12.5
Power (dBm):            11.7 1.8
Interleave depth:        1029 253
INP:                    8.00 4.00
G.INP:                  Not enabled Not enabled
Vectoring status:        5 (VECT_UNCONFIGURED)

RSCorr/RS (%):          0.0000 0.0000
RSUnCorr/RS (%):        0.0000 0.0000
ES/hour:                0 0
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: adslmax on December 05, 2017, 11:14:29 AM
@ fergie how did it work with DSLstats with TP LINK VR2800? As I did try it with TP LINK VR2600 but it doesn't work when I put TP LINK as VDSL Router mode on. Very odd. Maybe VR2800 got broadcom chipset than VR2600?
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: fergie on December 06, 2017, 12:16:24 AM
Just followed the above posts from Dink / siofjofj and it just worked.

Yes, the VR2800 has the Broadcom BCM63138 chipset:

Code: [Select]
# cat /proc/cpuinfo
Processor       : ARMv7 Processor rev 1 (v7l)
processor       : 0
BogoMIPS        : 398.13

processor       : 1
BogoMIPS        : 398.13

Features        : swp half thumb fastmult edsp tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x4
CPU part        : 0xc09
CPU revision    : 1

Hardware        : BCM963138
Revision        : 0000
Serial          : 0000000000000000

I guess maybe doesn't work for the VR2600's BCM63268?
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: fosseperme on December 30, 2017, 03:32:33 PM
not work on VR2800v (German Version)....the chipset xdsl is BCM63136v. I copied the content of the file with RouterPassview, save it in xml with notepad++ (with string telnetd added) and reconverted in bin with statposter (i tried all models). The webgui says file too large (about 100KB vs 10KB of the original bin).
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: BM on September 29, 2018, 02:44:58 PM
Apologies for resurrecting this oldish thread. I've been following the instructions for my VR600. I've downloaded the current config, used RouterPassView to decode, added the telnet line

Code: [Select]
    <DeviceInfo>
      <ManufacturerOUI val=xxxx />
      <SerialNumber val=xxxxx />
      <HardwareVersion val="Archer VR600 v1 00000000" />
      <SoftwareVersion val="0.2.0 0.9.1 v0057.0 Build 160614 Rel.41735n" />
      <UpTime val=12 />
      <X_TP_IsFD val=3 />
      <Description val="http://www.tp-link.com`telnetd -p 1023 -l login`" />
    </DeviceInfo>

Used StatPOSTer-test3 and StatPOSTer-20160306 to create a new file with TD-W9970 option (not the V1)

2018.09.29 14:18:44 config encrypt: wrote C:\Users\Paul\Downloads\confnew.bin
16 byte MD5 checksum B85710EF75E1542FB5BE1CD23045228A
38923 bytes of data
5 bytes zero padding

When I try to restore the config I get 4501 error - Wrong file

The confnew.bin file decodes correctly in RouterPassView, but there are blank/space lines e.g.

    <DeviceInfo>

      <ManufacturerOUI val=xxxx />

      <SerialNumber val=xxxx />

      <HardwareVersion val="Archer VR600 v1 00000000" />

      <SoftwareVersion val="0.2.0 0.9.1 v0057.0 Build 160614 Rel.41735n" />

      <UpTime val=12 />

      <X_TP_IsFD val=3 />

      <Description val="http://www.tp-link.com`telnetd -p 1023 -l login`" />

    </DeviceInfo>

Does anyone have any suggestions?

Thanks

BM
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: ejs on September 29, 2018, 03:24:20 PM
Try the other program which can do the compression properly:
https://forum.kitz.co.uk/index.php/topic,17108.msg368999.html#msg368999

Throwing the TP-Link in the trash and getting another router would be a preferable option.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: BM on September 29, 2018, 04:41:33 PM
Thank ejs,

I've had to install the VR600 because my Billion 8800NL R2 with most recent firmware 2.52.d10 installed in Mar 2018 which has been rock solid has restarted 4 times over the last 5 days - 3 of the restarts occurred within a 1 hour period on Friday afternoon. Billion Support are aware and there is a patch being tested by other customers, but in the meantime I need a stable connection.

On a slightly different tack, the 8800NL R2 is a little dated. Any suggestions for a reasonably priced replacement? I'm on Huawei cabinet about 560 metre away (straight line) from the property.

Thanks

Paul
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: Postal on September 11, 2019, 06:29:35 PM
Sorry for bumping an old thread.  Due to the death of my Billion 8800NL I picked up a VR900 V3(EU) on Monday which has the restricted Telnet capability (although I did not realise that until I got the box home and connected the router).  Being a bit huffed because I had lost the capability to run router-monitoring software like RouterStats or DSLStats, I did a bit of ferreting round the internet until I found this thread.  Finding it has made an old man happy.  Thanks to the StatPOSTer tool from ejs and the Janet-and-John explanation from Dink, I have managed to create an edited .bin file which re-loaded successfully so that I now have DSLStats up and running.

One minor glitch which may have been due to en error on my part at some stage in the process; when the new .bin file was loaded and the router re-booted itself the IPV6 network connection was disabled and I had to manually re-enable it.  Apart from that everything seems hunky-dory so far.

Big shout out to ejs, Dink and all of the others who have made their contributions to this topic for helping the rest of us to get proper stats down from the router rather than only the bits that TP-Link want us to see.  Please take this post as confirmation that the solution works for the VR900 V3 (aka AC1900 or C9) as well as for the other routers verified further up the topic.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: burakkucat on September 11, 2019, 06:52:40 PM
Welcome to the kitz forum.  :)

Thank you for taking to the time to report your success. I sure the members involved will appreciate your accolade.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: gigio68 on November 21, 2019, 12:34:10 AM
Hi All, Sorry to be late for the "party"  ;D

I have recently purchased a TP-Link TD-W9970 v3, which I use as a VDSL2 modem, while using Google mesh for the wifi in the house.
I am pretty happy with the stability of the TP-Link, compared to a "dog" Asus which I am sending back to the ISP.

However, to get more evidence and attempt to remove a cap to the speed that it seems I have (DL speed seems to have been put to 60Mbps, while I could reach 78Mbps max rate with previous supplier).

The TP-Link router has limited CLI capability and I have realised, following several of the useful posts in this forum, that I could remove this limitation, quite easily.
I have therefore installed the python script described here https://forum.kitz.co.uk/index.php/topic,14377.msg357441.html#msg357441 (https://forum.kitz.co.uk/index.php/topic,14377.msg357441.html#msg357441), added the extra line <Description val="Modem Router`telnetd -p 1023 -l login`" />  as suggested, created config.bin file from the modified xml file, using the python script, and added the newly created config.bin to the router.

The restore process was successful, until a message 403 forbidden appeared and I had to reboot the router.

Luckily the router is still functioning, however the modification was not accepted, so the extra line included to the xml file is not there anymore (if I go through the process of decrypting the bin file again)

What am I doing wrong? Has anyone managed to flash the v3 of this router?

Thanks
Giuseppe 
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: gigio68 on November 21, 2019, 12:09:55 PM
I have actually made it work.....

Not sure which one of the above did it, but, after I re-encrypted the modified xml file and loaded the bin into the web-interface of the router, I did not get the 403 message and I got DSLstats working

The userid and password, though, have not changed from what I had previously in my router. And I managed to keep all port forwarding and all other settings.
Next step is to get familiarised with the "overwhelming" tool.... :no:
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: mofa2020 on February 18, 2020, 12:06:40 PM
Sorry for reviving old post, but I have a problem with StatPOSTer which is not creating the encrypted config.bin file after I choose the .xml file and the new file name which is conf.bin nothing changed after I press ok and no "new" conf.bin is created I tried all the router modes "beside decrypt encrypt" but nothing changed,, am I using it wrong?

This is for TP-link archer vr400.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: foxtrot_yankee on September 21, 2020, 03:37:52 PM
Struggling to get this working with my VR2800...

I've managed to decrypt the conf.bin, add the telnetd line to the xml, then encrypt it again with tpconf_bin_xml.py

The config looks correct in the new bin on RouterPassView

The new filesize is only 1KB more than the original bin (9KB)

But I still get an Error Code: 4501 message

Any help most appreciated!
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: unc0der on November 09, 2020, 05:32:00 AM
Just wanted to say thanks to @Dink (https://forum.kitz.co.uk/index.php?action=profile;u=9730) & @siofjofj (https://forum.kitz.co.uk/index.php?action=profile;u=9949) for their detailed explanation. I got it working on my VR600 V2.

Just one more thing, is it normal that line attenuation differs from the web version?

(https://i.imgur.com/hwK4ZES.png)
p.s. I know I need to change my cable, it's pretty bad.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: tubaman on November 09, 2020, 07:41:30 AM
...

Just one more thing, is it normal that line attenuation differs from the web version?

...

I'd say the DSL Stats version is about right given your line speeds. Upstream usually shows as zero in my experience, but it is odd that your upstream SNR margin is so high - especially so as G.INP is running there too.
 :)
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: mofa2020 on November 09, 2020, 11:24:26 AM
I got it working on my VR600 V2.

Welcome to the forum  :)

Did you use StatPOSTer to encrypt the .xml file into .bin? I am using the VR400 V2 and tried this step on two computers and StatPOSTer did not create any .bin file on both of them, so if you could tell me which Windows version you are using or anything that can help me..

For your line attenuation, I believe that web version is more correct as if you look to DSLstats upstream attenuation is 0db which can not be true even the 27.9db attenuation might be not accurate I guess it would lead to lower attainable/sync. speed.. BUT in general VDSL signal is divided into bands and each band has its own attenuation so somehow routers shows something like average attenuation between bands for download and upload.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: roseway on November 09, 2020, 12:33:34 PM
DSLstats reports the values provided by the 'official' Broadcom commands, so they should be more correct than the values given in the GUI. An upstream attenuation of 0 dB is obviously not real, but that is what the Broadcom command reports.
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: unc0der on November 10, 2020, 01:01:04 AM
Welcome to the forum  :)

Did you use StatPOSTer to encrypt the .xml file into .bin? I am using the VR400 V2 and tried this step on two computers and StatPOSTer did not create any .bin file on both of them, so if you could tell me which Windows version you are using or anything that can help me..

For your line attenuation, I believe that web version is more correct as if you look to DSLstats upstream attenuation is 0db which can not be true even the 27.9db attenuation might be not accurate I guess it would lead to lower attainable/sync. speed.. BUT in general VDSL signal is divided into bands and each band has its own attenuation so somehow routers shows something like average attenuation between bands for download and upload.
Just make sure to choose TD-W9970 before you encrypt the XML file.

[Moderator edited to fix the broken bullet-point list.]
Title: Re: Getting extra DSL stats from TP-Link modem/routers
Post by: mofa2020 on November 18, 2020, 11:06:19 PM
  • Windows 10 v1909
  • java version "1.8.0_271"
  • Java(TM) SE Runtime Environment (build 1.8.0_271-b09)
Just make sure to choose TD-W9970 before you encrypt the XML file.

[Moderator edited to fix the broken bullet-point list.]

Thank you for the info,, tried again with no luck so I put the file on a usb stick and got the job done in internet café (I believe PC was running Windows 7) however after restoring the new conf file the router worked fine for sometime then line resynced and to my surprise found the attainable/sync. speeds dropped by ~ 50% tried to fix things with a resync. but no luck so I reverted back to the router I were using and speeds jumped to normal again.. do not know what happened..