nox-x / TG3442DE-Teardown

Teardowning a Vodafone TG3442DE Cable router

32 stars 6 forks source link

arris arris-modem docsis teardown

readme

TG3442DE Teardown

A fun project disassembling and understanding a Vodafone TG3442DE cable router (aka Arris Touchstone TG3442: commscope.com product page).

Goals

Using the cable-interface for wiretapping and analyzing the DOCSIS 3.1 Protocol
Understanding why Vodafone does not support IPv6-addresses while the router is in bridge mode (to be proven: IPv6 is used for VoIP-Telephony and is therefore terminated at the TG3442 running in bridged mode)

Hardware

For Hardware-Identification see: Hardware.md

Information:	Description:
Branding:	`Vodafone`
Model No.:	`TG3442DE`
Hardware Version:	`MP1`
CPU:	`Intel FHCE2752M` (Intel Puma 7 SoC CE2752M) 2 cores, 2.5 GHz, Intel Atom Arch (Intel Puma 7 product family page)
RAM:	`Samsung K4B2G1646F-BYK0` ???Capacity used (4x512 MByte?)??? 4x DDR3-RAM (Samsung product page) [FIXME: exact capacity]
Flash:	`Kioxia TC58NVG2S0HBAI4` 512 MByte SLC NAND EEPROM (Toshiba/Kioxia product page)
Subscriber Line IC (SLIC):	`Microsemi ZL88107` Microsemi Corporation, ???maybe part of ZL880 series -> product page??? [FIXME: exact ref missing]
eMMC:	`Phison PS8211-0`
2.4GHz RF:	`Celeno CL2432` 3x3 802.11ac 2.4GHz RF chip (celeno.com product page)
5GHz RF:	`Celeno CL2440` 4x4 802.11ac Wave 2 5GHz RF chip (celeno.com product page)
cable gateway SoC:	`MaxLinear MXL277` cable gateway, front-end SoC designed for DOCSIS 3.1 (maxlinear.com product page)
cable upstream amplifier:	`MaxLinear MXL236` PGA IC designed for DOCSIS 3.1 (maxlinear.com product page)

Firmware/Software

For documentation on the software see: Software.md

Related and interesting stuff