Share
-
JUST FOR FUN
DOCSIS and Cable Modems – How it works :: Cable Modem Registration
Through DOCSIS tutorial seminars, I have found the most effective way to bring someone up to speed on DOCSIS communications is by teaching the cable modem registration process. During the registration process, we will cover the RF physical layer, the DOCSIS Media Access Layer (MAC) and the Internet Protocol (IP) layer. Yes, the cable modem exercises the first three layers of the Open Systems Interconnection Reference Model (OSI Reference Model or OSI Model).
First let’s consider the picture below to understand conceptually the DOCSIS network as it exists in a standard cable TV (hybrid fiber-coax or HFC) network.
DOCSIS in an HFC Network
On the left is a Cable Modem Termination System (CMTS) that is connected to an Internet back bone. To the CMTS is also connected a number of servers which run a Dynamic Host Configuration Protocol (DHCP) server, a Trivial File Transfer Protocol (TFTP) server, and a Time of Day (ToD) server. The CMTS transmits downstream data via 64- or 256-QAM signals over the RF Plant to the subscriber’s home cable modem. The cable modem transmits data to the CMTS on the upstream over the RF Plant via QPSK, 8-, 16-, 32, or 64-QAM modulation. It is at this point that we must make the assumption that the RF Plant (essentially miles of coaxial cable, fiber optic cable, RF amplifiers, a fiber optic node, Erbium-doped fiber optic amplifiers and countless RF passive devices) is capable of supporting the RF modulations being transmitted by the DOCSIS devices without significant degradation to stop higher layer communications.
Downstream DOCSIS Channel Lock
Once a cable modem is powered on and connected to the RF cable of a CATV network, it will begin a “hunt” for a valid downstream DOCSIS channel. First the cable modem looks for and locks to any 64- or 256-QAM digital channel. Fortunately for the modem, the CMTS is sending out a “Sync” broadcast at least every 200 msec, which is used for system timing. In addition, the CMTS sends out an Upstream Channel Descriptor (UCD) every two seconds, which tells modems the upstream frequency to transmit on, symbol rate, modulation profile, and other parameters necessary to communicate on the network. Finally the CMTS is sending out Media Access Protocol (MAP) messages to allocate “talk time” to each cable modem. You see, since there are many cable modems and only one upstream frequency, the cable modems must “time-share” the upstream channel, which is called Time Division Multiple Access (TDMA). Now, when the cable modem successfully locks to a QAM channel, it looks for the Sync, UCD and MAP messages from the CMTS. If it finds these it knows it is on an active DOCSIS channel. If they are not present, the cable modem assumes the DOCSIS channel is offline or it is on a video QAM channel and continues its search.
Assuming a successful lock above, the cable modem is now ready to begin ranging with the CMTS. The ranging process begins with Initial Ranging, which is a process in which the cable modem begins by sending a Range-Request at a power of 8 dBmV (very low power). If it does not receive a Range-Response from the CMTS the cable modem retransmits the Range-Requests at a 3 dB higher power level and continues the process until a Range-Response is received. See the following diagram:
Ranging with CMTS
All initial ranging occurs during a “contention” window, which means that the CMTS does not have prior knowledge of the cable modems existence. Therefore it is possible that when multiple cable modems are attempting to register during the contention window that they could interfere with each other and cause collisions. DOCSIS has a built-in back-off window for just such an occurrence which will help alleviate collisions in the contention window. This is most prevalent when there is a system outage and many cable modems are trying to come back online at the same time. Once the modem has received its first Range-Response from the CMTS it will moved from Initial Ranging to Station Maintenance. The cable modem will also be instructed by the CMTS to make adjustments to its transmitting frequency, amplitude, timing offset and optionally pre-equalization. Station Maintenance (Ranging) will occur at least once every 30 seconds for each cable modem on the DOCSIS network to continue making these adjustments and so that the CMTS knows the modems are online.
Next the cable modem is ready to move from DOCSIS protocol communications to IP layer communication and perform DHCP to get an IP address and the addresses of other devices in the network. Now that the cable modem is operating within its TDMA parameters, it must first ask for permission to transmit data to the CMTS by sending a bandwidth REQUEST. The CMTS will prioritize the request in its queue and issue a MAP for the specific cable modem. When the cable modem’s time slot comes up, it can transmit a DHCP discover to find a DHCP server. The DHCP server on the network will respond and offer an IP address to the cable modem along with a number of other network addresses, gateways and parameters for proper network operation. A DHCP Request and Acknowledgement are required to complete and confirm the transactions.
DHCP and ToD
Next the cable modem will request the Time of Day from the ToD server. This is a simple transaction that was a requirement in DOCSIS 1.0, but has now become an option in later release of the specification. We will see in DOCSIS 3.0 that more emphasis is placed upon the critical nature of over-all network timing accuracy, but this will be addressed in a later post.
Now the cable modem is ready to download a very important file called a configuration file from the TFTP server. The configuration file contains all of the parameters the cable modems needs for network access speeds, quality of service, advanced service features such as voice-over-IP and much more. The following diagram illustrates the flow of procuring the configuration file.
TFTP Download and Registration
Upon validating the MD5 check-sum to ensure the TFTP file was properly downloaded, the cable modem is now ready to perform the most important step – registration. The cable will send a Registration Request to the CMTS along with a list of TLV (Type Length Value) parameters that tell the CMTS how the cable modem has been told it is to operate on the network. The CMTS reviews this information against the parameters it has been programmed with by the system administrator. Provided the cable modem has not be “hacked”, data has been corrupted or there is an interoperability issue, the CMTS will send a Registration Response “Okay” message and assign the cable modem a Service IDentifier (SID). The cable modem will respond back with a Registration Acknowledgment notifying the CMTS that it has received confirmation of registration and it is now online and ready for subscribers to transmit Internet data.
So as a basic recap, the process goes throught the following steps:
- Downstream Channel Search and Lock
- DHCP
- ToD
- TFTP
- Registration
After registration a cable modem could next enter an encryption mode called Baseline Privacy Interface (BPI) protocol, but I will save that topic for a blog of its own.
Thanks Brady,
very informative, can please provide me more information about the internal components of CMTS and SRM.
Regards,
ISHWAR
[Google Translate]
Yes Ishwar, as I get more in-depth into the DOCSIS specification I will be discussing the building blocks of a CMTS. This will become especially critical for DOCSIS 3.0 where the CMTS is transformed from a single box into a modular device.
[Google Translate]
Brady:
First of all, I really appreciated this blog. It has been very useful for me to understand the DOCSIS 3.0 concepts at a much faster pase as compared to reading the specs from CableLabs. This article, Cable Modem Registration, especially helped me a lot.
It would also be helpful if you could breakdown information on the modular cable modem termination system (M-CMTS) that is an emerging platform which many companies are gearing towards. Also if you could provide details and concepts regarding Edge QAM (EQAM), a key element of the M-CMTS architecture, that would be very much appreciated.
Thank you.
Regards,
Gopi
[Google Translate]
Gopi,
Thanks for the feedback. I plan on getting to M-CMTS and eQAM topics after I cover the DOCSIS 101 basics. I’m working on a UCD post right now that I hope to get out today.
-Brady
[Google Translate]
Hi Brady,
Thanks for a fascinating and well-written blog, I’ve just stumbled across it and enjoyed reading your articles.
So sorry to be a pedant, but I think i spotted a typo/thinko. Aren’t the registration request TLV parameters *Type*-Length-Value tuples?
[Google Translate]
Quite right you are Dave. Thanks for catching the typo. I have made the correction.
-Brady
[Google Translate]
thank you very much sir, really good one.
[Google Translate]
Hi Brady,
Great job. Its highly informative. Thanks a ton
Indhra.
[Google Translate]
Hi Brady,
Superb article yar.. But I need a clarification..
CM is a layer 2 device. Then why it needs IP address..
Thanks,
Vini
[Google Translate]
Brady,
Thanks for these great topics. I just started a new job with a major CMTS vendor and these are very helpful. Thanks again and keep up the good work.
[Google Translate]
Hi Brady,
This article about CM registration is really very helpful.
I have a couple of questions.
1) For example, if we take Amplitude Modulation, the AM receiver can receive the signals within the radius of 100miles from the AM transmitter.
Like wise, what is the distance between the CMTS and the CM to receive the signals.
2) We are having HFC network in DOCSIS. Whether it is near or far from the MSO (where the CMTS resides). At which point the HFC network has been set up ?
Thanks for this informative blog.
Thanks once again,
Sathish.
[Google Translate]
Hi Sathish,
According to the DOCSIS specification, the maximum distance between CMTS and CM specified in DOCSIS of 100 miles or roughly 160 km. Now one must take into consideration both the fiber optic cable, in which light actually travels slower that electrons (a commonly unknown fact and also thermal variations). For example, 25 km fiber and a 2 degree temperature change will result in a 2 ns change in propagation delay. For buried or underground cable, there is no temperature change or at least small enough change to not include in calculations. When the rising sun hits aerial cable on a cold morning, one would expect a temperature change. Similarly, sunlight appearing out of cloud cover may have a similar impact although the size of the shadow of the cloud moving out of the way has to be considered. The numerical examples above suggest that only long aerial cable runs may have a problem under some combinations of time-of-day and weather. Aerial cable stretches with wind loading, so it is possible to estimate a propagation delay from the change in length under various wind loads. As an example, with 5 miles (8 km) and 0.02% length variation, the change in propagation delay is:
(8/3e5)*(1/0.87)*2e-4 seconds = 6 nanoseconds
So, as you can see there many variables that can impact plant performance at the 100 mile mark of a DOCSIS plant. A good rule of thumb would be to not push the limits of the specification out to 100 miles if you plan on delivering high quality services such as VoIP of IPTV at those locations.
Regards,
-Brady
Note: The examples in the above email were taken directly from the DOCSIS 2.0 RFI.
[Google Translate]
Echoing all of my contemporaries comments on the value of the blog and quality of the content. As an engineer (IP / OSI / DOCSIS type) managing a CMTS network, we are sometimes at odds with some of our RF counterparts with respect to fault isolation and where performance problems are occuring. For instance … modems taking 5 ~ 15 minutes to synch in one area of the network, and uwards of an hour on other areas (different nodes).
What are your recommendations on DOCSIS protocol analyzers? When I have a problem in the Ethernet / IP world, I break out an analyzer and determine what’s happening at the packet level. Searching for the best analyzer to provide that level of visibility on the DOCSIS side of the fence.
When our installation team and plant maintenance folks tell us that the CNR / SNR levels look good, and the RF appears to be clean, and we are still seeing problems on the network (poor speeds, flaps, etc.) , I need a closer look at what’s going on with any signalling, timing, ranging & registration.
[Google Translate]
Hello,
I would like to thank you for this great article!
Looking forward to see th eannounced article “After registration a cable modem could next enter an encryption mode called Baseline Privacy Interface (BPI) protocol, but I will save that topic for a blog of its own.”
Also, are High Pass filters put on cable to isolate the TVs from cable modem transmissions or the other way around?
Thank you!
[Google Translate]
Hi Vendy,
On the BPI, I have been asked to not provide a “How to hack cable modem’s BPI+ security in layman’s terms”, so I will not be doing a special on BPI. Sorry for that.
But to answer your question on High Pass filters, they are installed to protect TV’s from cable Modems. This is especially true with newer cable modems (DOCSIS 3.0) or Euro-DOCSIS modems. D3.0 modems transmit up to 80 MHz and Euro-DOCSIS modems transmit up to 60 MHz. in either case, many TVs receive down to 50 MHz. So in theory the cable modem could transmit at very high levels into the frequency range that the TV set could be receiving. This would cause distortion and possible over-load on your TV set.
Regards,
-Brady
[Google Translate]
Nice post. I have a novice question. Does every cable modem gets a different down stream frequency?
Thank you.
Murthy
[Google Translate]
Murthy,
Everyone starts somewhere. Every cable modem receives the same downstream frequency. Data sent to the cable modems flows in one continuous MPEG-2 Transport Stream (TS). Buried in this stream of data are Service Identifiers (SIDs) for each cable modem so that when data is transmitted to a modem, the SID acts as a tag to tell the modem when data is meant for that specific modem. This basically means that you can have hundreds of modems or more listening to one downstream 6 or 8 MHz QAM channel. The data takes care of the rest.
Regards,
-Brady
[Google Translate]
very good post, help me alot
if i move to another home/far away (still same tv cable operator), does my cable modem need more longer time to lock again than before?
sory for my english
thanks,
tatak
[Google Translate]
Hi Tatak,
If you move and take your cable modem with you, it is likely that you will be registering on a different CMTS. At the same time, depending upon your cable operator, you may or may not be registering with a different provisioning server. So there are a couple of things that come into play here that I will discuss.
First, depending upon your cable operator, often times cable operators will put into place security measures to lock the MAC address of your cable modem to a specific CMTS. This prevents hackers from spoofing your MAC address and BPI certificate somewhere else in the cable network. So if you suddenly show up on a different CMTS it is possible that you will be rejected.
Second, if your cable operator has multiple provisioning servers, you may need to be added to the provisioning server in the new area that you are moving (I don’t know if your moving a very short distance or across many states). If you are not provisioned on the provisioning server, there is no way that the provisioning server will recognized your cable modem’s MAC address as valid and allow it on the network.
So in summary, if you are moving, it is always a good idea to let your cable operator know about the move and your new address so that they can make certain they have you provisioned in their back office system
-Brady
[Google Translate]
Hi Brady,
I am looking for the docsis algorithm in case there are 2 CMTS with 2 different downstreams on the same physical network.
Let’s say modem1 belongs to CMTS2 but it hooks up first on CMTS1. It will be ok until the dhcp step. If it’s refused by dhcp server, will it go on and look for another downstream frequency ? What is the modem supposed to do ?
[Google Translate]
Hi Jerome,
Just as in the case when the cable modem locks onto a channel that is a QAM video channel and finds out it is not a DOCSIS channel, because there is no UCD, MAPs, etc., when it is rejected by the DHCP server it will continue with its search for Downstream channels starting with the next channel in its channel table.
Regards,
-Brady
[Google Translate]
[...] [...]
[Google Translate]
Brady,
Nice work. I was just catch up on the new 3.0 standards the other day, having to review some old the older standards since its been so long.
I did a fair amount of reading a while back about this, never really playing with it due to the legality of it; Modem capping, which is becoming harder as the standards are built with higher security standards.
Upstream capping, little more comfortable with this. Downstream capping, looks like it is more based on a transmission control protocol conforming to its standards. If accessed a tcp application that was pumping data that exceed the cap, then ack packages would be missed and tcp backoff procedures would come into play (CM would drop data). For UDP streamed, even though the CM may drop the data, the data may keep flooding the network, exceeding the customer contract.
Looks like most of the policing itself would still have to come at the headend to enforce customer contracts.
[Google Translate]
im noob on subject but interested,and helpfull thanks brady.
[Google Translate]
Quick question:
You mentioned that the CM receives a new range request at least once every 30 seconds. When the CM re-ranges per say, does it follow the other steps afterward such as DHCP and TFTP download as well?
I’m trying to figure out here if there is anything that would cause a CM to request/download a new TFTP file besides a hard reset. I know that when the DHCP request is sent out to the DHCP server, DHCP IP info as well as configuration file name from TFTP info is sent back. So when the modem receives the TFTP file info back from the DHCP server — If the TFTP filename is different, would the CM then download the new file?
Just wondering… I have a setup here using CNR and a uBR10k and SOMETHING is causing our modems to update their configs every 24-48 hours. DHCP requests would make sense.
[Google Translate]
The Range-Request (or Station Maintenance) that occurs at least once every 30 seconds does not cause a DHCP. If you modems are re-registering every 24-48 hours it is likely because your DHCP expiration time is set to a very short time.
Check your DHCP server (CNR) and look at the lease time of your IP addresses. Make sure that it is set to something like 7 days or maybe 1 year, depending upon your needs.
-Brady
[Google Translate]
Thanks a lot for your help. I’m new on that. I have a CMTS Nortel 1000. I plan to build a radius server. I have also a mikrotik router 1100. My question: It is possible that, with this software and hardware to connect Cable modems at my network , or I may need something else?
Thanks a lot
Tani
[Google Translate]
Hi Tani,
You should be able to setup a DOCSIS network with the Nortel1000, which I believe is actually a Cornerstone1000 CMTS. The operating system (IOS) is likely old and most likely only support DOCSIS 1.0. You can probably find someone who can provide you with an update to 1.1 for that model if you check around on the forums. You would then integrate your radius server into your DHCP server for provisioning CPE devices access to the network. The cable modems themselves should be put on a local, non-route-able subnet, such as a 10.0.0.0 or 192.168.0.0 network.
-Brady
[Google Translate]
Dear sir
we have work underground networking access net and overhead
building constructions releated job so cable fiber and server
work do my company has worked large company which is telcome
commucation.so we provide work cable.
Regarding
Three Brothers & Co.
Mo.No.- 09312523790
[Google Translate]
Hi Three Brothers,
For any consulting related posts, please refer to my consulting related site at The Volpe Firm.
Thanks and looking forward to hearing from you.
Regards,
-Brady
[Google Translate]