How can I decode/encode a cable modem configuration file?

Question

I'm currently looking into some of the inner workings of DOCSIS and related. One thing I'm struggling a bit with is how cable modem config files are made.

From what I've gathered:

CM configs are binary files based on a TLV format.
These configs are deployed using a TFTP server, hinted via DHCP to the modem itself when it boots.

I'm interested in knowing how these config files are structured. I have next to no knowledge of TLV aside from what I've read these past days.

Is TLV just a generic method of stringing data together? It seems like TLV is used in both binary forms and json-like strings of clear text.
Is the T and/or L parts of TLV a set size (in bytes)? How do I know where they separate?
I think I read somewhere that CM configs use a subset of TLV called TLV-BER. If I'm not mistaken, this adds support for TLV nesting. How does this work?

I've heard that DOCSIS is well documented over at CableLabs, but I haven't been able to find this information yet. Helpful links are appreciated.

I have a binary config file in my possession that I've been able to decode using online tools, but assume I want to make my own tool for this purpose, how would I go about it?

Edit: Here's an excerpt of the first 64 bytes of the binary file, for reference.

03010112 01021916 08040668 51E00601 07070104 01020065 09040000 17C8181D 
08040203 A0000904 00001F40 0E021F40 01020001 0F010207 01040601 07270101

I think at the least you'd need to include a portion of a hex dump of what these files look like. — Ian Boyd, Jun 21 '19 at 17:14

Ian Boyd · Accepted Answer · 2019-06-24T18:24:43.110

03 01 01              ;  3 - Network access control: ON
12 01 02              ; 18 - Max Number of CPEs: 2
19 16                 ; 25 - Downstream service flow
   08 04 06 68 51 E0  ;    25.8  - Maximum Sustained Traffic Rate
   06 01 07           ;    25.6  - Quality of Service Parameter Set Type: prov/adm/active
   07 01 04           ;    25.7  - Traffic Priority: 4
   01 02 00 65        ;    25.1  - Service Flow Reference or ASF Reference: 65
   09 04 00 00 17 C8  ;    25.9  - Maximum Traffic Burst: 6,088
18 1D                 ; 24 - Upstream service flow
   08 04 02 03 A0 00  ;    24.8  - Maximum Sustained Traffic Rate: 33,792,000
   09 04 00 00 1F 40  ;    24.9  - Maximum Traffic Burst: 8,000
   0E 02 1F 40        ;    24.14 - Maximum Concatenated Burst: 8,000
   01 02 00 01        ;    24.1  - Service Flow Reference or ASF Reference: 1
   0F 01 02           ;    24.15 - Service Flow Scheduling Type: 2
   07 01 04           ;    24.7  - Traffic Priority: 4
   06 01 07           ;    24.6  - QOS: 0x07 (prov|adm|active)
27 01 01              ; 39 - Enable 2.0 Mode: ON

Types

Type      Description                                                Spec Defined
========  =========================================================  ============
0         Pad                                                        DOCSIS 1.0
1         Downstream Frequency                                       DOCSIS 1.0
2         Upstream Channel ID                                        DOCSIS 1.0
3         Network Access Control Object                              DOCSIS 1.0
4         DOCSIS 1.0 Class of Service                                DOCSIS 1.0
5         Modem Capabilities Encoding                                DOCSIS 1.0
6         CM Message Integrity Check (MIC)                           DOCSIS 1.0
7         CMTS Message Integrity Check (MIC)                         DOCSIS 1.0
8         Vendor ID Encoding                                         DOCSIS 1.0
9         SW Upgrade Filename                                        DOCSIS 1.0
10        SNMP Write Access Control                                  DOCSIS 1.0
11        SNMP MIB Object                                            DOCSIS 1.0
12        Modem IP Address                                           DOCSIS 1.0
13        Service(s) Not Available Response                          DOCSIS 1.0
14        CPE Ethernet MAC Address                                   DOCSIS 1.0
15        Telephone Settings Option (deprecated)                     DOCSIS 1.0
17        Baseline Privacy (Security)                                DOCSIS 1.0
18        Max Number of CPEs                                         DOCSIS 1.0
19        TFTP Server Timestamp                                      DOCSIS 1.0
20        TFTP Server Provisioned Modem IPv4 Address                 DOCSIS 1.0
21        SW Upgrade IPv4 TFTP Server                                DOCSIS 1.0
22        Upstream Packet Classification                             DOCSIS 1.1
23        Downstream Packet Classification                           DOCSIS 1.1
24        Upstream SF                                                DOCSIS 1.1
25        Downstream SF (11.4)                                       DOCSIS 1.1
26        Payload Header Suppression                                 DOCSIS 1.1
27        HMAC-Digest                                                DOCSIS 3.1
28        Maximum Number of Classifiers                              DOCSIS 1.1
29        Privacy Enable                                             DOCSIS 1.1
30        Authorization Block                                        DOCSIS 1.1
31        Key Sequence Number                                        DOCSIS 1.1
32        Manufacturer Code Verification Certificate                 DOCSIS 1.1
33        Co-Signer Code Verification Certificate                    DOCSIS 1.1
34        SNMPv3 Kickstart Value                                     DOCSIS 1.1
35        Subscriber Mgmt Control                                    DOCSIS 1.1
36        Subscriber Mgmt CPE IPv4 List                              DOCSIS 1.1
37        Subscriber Mgmt Filter Groups                              DOCSIS 1.1
38        SNMPv3 Notification Receiver                               DOCSIS 1.1
39        Enable 2.0 Mode                                            DOCSIS 2.0
40        Enable Test Modes                                          DOCSIS 2.0
41        Downstream Channel List                                    DOCSIS 2.0
42        Static Multicast MAC Address                               DOCSIS 2.0
43        DOCSIS Extension Field                                     DOCSIS 1.0
44        Vendor Specific Capabilities                               DOCSIS 1.0
45        Downstream Unencrypted Traffic (DUT) Filtering             DOCSIS 2.0
46        Transmit Channel Configuration (TCC)                       DOCSIS 3.0
47        Service Flow SID Cluster Assignment                        DOCSIS 3.0
48        Receive Channel Profile                                    DOCSIS 3.0
49        Receive Channel Configuration                              DOCSIS 3.0
50        DSID Encodings                                             DOCSIS 3.0
51        Security Association Encoding                              DOCSIS 3.0
52        Initializing Channel Timeout                               DOCSIS 3.0
53        SNMPv1v2c Coexistence                                      DOCSIS 3.0
54        SNMPv3 Access View Configuration                           DOCSIS 3.0
55        SNMP CPE Access Control                                    DOCSIS 3.0
56        Channel Assignment Configuration Settings                  DOCSIS 3.0
57        CM Initialization Reason                                   DOCSIS 3.0
58        SW Upgrade IPv6 TFTP Server                                DOCSIS 3.0
59        TFTP Server Provisioned Modem IPv6 Address                 DOCSIS 3.0
60        Upstream Drop Packet Classification                        DOCSIS 3.0
61        Subscriber Mgmt CPE IPv6 Prefix List                       DOCSIS 3.0
62        Upstream Drop Classifier Group ID                          DOCSIS 3.0
63        Subscriber Mgmt Control Max CPE IPv6 Prefix                DOCSIS 3.0
64        CMTS Static Multicast Session Encoding                     DOCSIS 3.0
65        L2VPN MAC Aging Encoding                                   DOCSIS 2.0
66        Management Event Control Encoding                          DOCSIS 3.0
67        Subscriber Mgmt CPE IPv6 Prefix List                       DOCSIS 3.0
68        Default Upstream Target Buffer Configuration               DOCSIS 3.0
69        MAC Address Learning Control Encoding                      DOCSIS 3.0
70        Upstream Aggregate Service Flow Encodings                  DPoE 2.0
71        Downstream Aggregate Service Flow Encodings                DPoE 2.0
72        Metro Ethernet Service Profile                             DPoE 2.0
73        Network Timing Profile                                     DPoE 2.0
74        Energy Management Parameter Encoding                       DOCSIS 3.0
75        Energy Mgt. Mode Indicator                                 DOCSIS 3.1
76        Energy Mgt. Identifier List for CM                         DOCSIS 3.1
77        DOCSIS Time Protocol Enable                                DOCSIS 3.1
78        AQM Disable                                                DOCSIS 3.1
79        UNI Control Encoding                                       DOCSIS 3.0
80        Energy Management – DOCSIS Light Sleep Encodings           DOCSIS 3.1
81        Manufacturer CVC Chain                                     DOCSIS 3.1
82        Co-signer CVC Chain                                        DOCSIS 3.1
83        L2CP Management                                            DPoE 2.0
201-231   eCM eSAFE Configuration File TLVs
201       ePS
202       eRouter                                                    eRouter
203-215   Reserved
216       eMTA                                                       PacketCable 1.x
217       eSTB                                                       DSG
218       Reserved
219       eTEA                                                       TEI
220       eDVA                                                       PacketCable 2.0
221       eSG                                                        SMA gateway
222-231   Reserved
255       End-of-Data                                                DOCSIS 1.0

Bonus Reading

Excellent. This type list in particular is something I've been looking for. I guess it was hidden deep in that PDF file. — Magnus Bull, Jun 25 '19 at 00:56

iso8583.info support · Answer 2 · 2019-06-23T18:42:14.653

0

Your HEX dump does not seems using ASN.1 BER encoding. It is TLV encoding with Tag field 1 Byte length and Length field 1 Byte HEX value. Tags 0x16, 0x18 and 0x1F seems constructed templates which contains another group of tags. Meaning of Tag Values lookup in your documentation.

Here is possible example of parsing in T-L-V separation form:

03-01-01
12-01-02
19-16 // template?
   08-04-066851E0
   06-01-07
   07-01-04
   01-02-0065
   09-04-000017C8
18-1D // template?
  08-04-0203A000
  09-04-0000
  1F-40 // template?
    0E-02-1F40
    01-02-0001
    0F-01-02
    07-01-04
    06-01-07
    27-01-01
    ...example cut here

edited Jun 23 '19 at 18:42

answered Jun 22 '19 at 05:38

iso8583.info support

2,130
14
18

I guess I don't know for sure if T and L are 1 byte each, but it _seems_ to be the case. How do you tell when a tag is a template? – Magnus Bull Jun 22 '19 at 17:14
I guess about the template tags with sub-tags basing on the length of value and its content. Parsing example updated. – iso8583.info support Jun 23 '19 at 18:46

How can I decode/encode a cable modem configuration file?

2 Answers2

Types

Bonus Reading