router – Experimental Engineering

Posted on March 18, 2017April 24, 2017 by The Engineer — 4 Comments

Virgin Media Hub 3 Crap & Router Upgrades

I posted a while back a teardown of the VM Superhub 2 router, as VM has “upgraded” to a rebranded Arris TG2492S/CE CM. Alas Virgin Media in their wisdom have decided that simple router features like being able to change the LAN subnet & DHCP server range are far too complex to trust to the Great Unwashed, so they’ve removed them entirely from the firmware, and locked the local LAN onto the 192.168.0.0/24 range.
As my network is already numbered in the 10.0.0.0/16 range, with several statically addressed devices present and other systems relying on these static assignments, using this router would have meant renumbering everything.

Luckily Virgin had the decency to leave the “modem mode” option in the firmware, effectively disabling the WiFi & routing functions & allowing the connection of a third-party router. Some searching for a suitable replacement for the core of my network turned up the Linksys WRT1900ACS. While I waited for this to arrive, some temporary workarounds were needed to make everything function well enough with VM’s crap router.

These routers have been designed as a modern replacement for the venerable WRT54G series of routers from some time ago, with full support for OpenWRT/DD-WRT firmware, and with a beefy 1.6GHz dual core CPU & 512MB of RAM I doubt I’ll be able to knock this one over with too much network traffic! This was pretty much the most powerful router I could afford, and should mean I don’t need to upgrade for a long time. (No teardown of this yet, as it’s taking care of the network at present. Maybe some point in the future I’ll take the plunge).

The stock firmware isn’t totally awful, and has some nice features, but I decided it needed to be replaced with DD-WRT for more security & future flexibility. I’ll leave the firmware flashing stuff for another post 😉

Posted on February 13, 2017February 4, 2017 by The Engineer — 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

A separate Ethernet PHY is located between the SoC & the switch IC.

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Pretty much the same for the 5GHz radio, but with 3 radio channels.

Posted on October 31, 2015 by The Engineer — 2 Comments

Cisco EA6700 / Linksys AC1750 Router

Since the boat was still running it’s internal network on 10/100M speeds, an upgrade was decided on, the internal WiFi signal strength was also pretty poor further than a few feet from the NOC.

The new router is a Cisco/Linksys AC1750 model, with gigabit networking, and full 802.11ac 2.4/5GHz Wireless. This router also has a built in media server, print server, USB3 & USB2.

Teardown time! Here’s the router with the cover removed. Most of the fun stuff is hidden under the shields, but these aren’t fully soldered down & the covers are removable. The 6 antennas can be seen spaced around the edge of the housing, the main CPU is under the large heatsink upper centre. The radio power amplifier stages are underneath the shields, while the main RF transceivers are just outside the shields.

Wireless N is provided by a Broadcom BCM4331, this provides full dual-band 3×3 802.11n support. Being 3×3 it is actually 3 separate transceivers in a single package, to get much higher throughput rates of 600Mbit/s.

Wireless AC is provided by it’s sister IC, the BCM4360, with throughput speeds of 1.3Gbit/s. Both of these transceiver ICs connect back to the main CPU via PCI Express.

To get increased range, there are a trio of Skyworks SE5003L +23dBm 5GHz power amplifier ICs under the shield, along with the TX/RX switching & antenna matching networks. Heatsinking for these is provided by a sink screwed to the bottom side of the PCB. The outputs to the antennas can be seen at the top of the image.

The 2.4GHz section is fitted with a trio of Skyworks SE2605L +23dBm 2.4GHz power amplifiers, with a similar heatsink arrangement under the board. Unlike the 5GHz section, the 2.4GHz antenna feeds are soldered to the PCB here instead of using connectors.

The main CPU is a BCM4708 Communications Processor from Broadcom, as for the other Broadcom chips in this router, very little information is available unless under NDA, but I do know it’s a dual core ARM Cortex A9 running at 1GHz, with built in 5-port gigabit ethernet switch.

Working RAM for the processor is a Hynix H5TQ2G63DFA 256MB part.

More to come on the installation of the new networking, with it’s associated 4G mobile gateway connection system.

73s for now!

Posted on August 3, 2015August 3, 2015 by The Engineer — Leave a comment

nb Tanya Louise Radio Install Part 1

I often find myself carrying by go bag up to the boat during trips, so I can do some radio. However at 16lbs it’s a pain on public transport. A fixed radio was required! Another Wouxun GK-UV950P was ordered, and the fact that the head unit is detachable from this radio makes a clean install much easier.

I found a nice spot under a shelf for the main radio unit, above is the mounting bracket installed.
This location is pretty much directly behind where the head unit is placed, but the audio is a bit muffled by the wooden frame of the boat & some external speakers will be required for the future.

Here’s the main radio unit mounted on it’s bracket, with the speakers facing down to improve the audio slightly. I used the supplied interface cable for the head unit, even though it’s too long. I do have the tools to swage on new RJ-45s, but the stuff is a pain to terminate nicely & I really just couldn’t be bothered. So it’s just coiled up with some ties to keep it tidy. Main power is provided directly from the main DC bus. (880Ah total battery capacity, plus 90A engine alternator, 40A solar capacity).

Here’s the main DC bus, with the distribution bars. With the addition of new circuits over the years, this has become a little messy. At some point some labelling would be a good idea!

Finally, the head unit is installed in a spot on the main panel. It does stick out a little more than I’d like, but it’s a lot of very dusty work with the router to make a nice hole to sink it further in. All my local repeaters & 2m/70cm simplex are programmed in at the moment.

I’ve got a Nagoya SP-80 antenna on a magmount for the radio, a magmount being used due to the many low bridges & trees on the canal. (It’s on the roof next to the first solar panel above). I prefer it to just fall over instead of having the antenna bend if anything hits it!

Part 2 will be coming soon with details of the permanent antenna feeder.

73s for now!

Posted on December 11, 2014December 11, 2014 by The Engineer — Leave a comment

uRadMonitor – Node Online!

It’s official. I’m now part of the uRadMonitor network, & assisting in some of the current issues with networking some people (including myself) have been having.

It seems that the uRadMonitor isn’t sending out technically-valid DHCP requests, here is what Wireshark thinks of the DHCP on my production network hardware setup:

As can be seen, the monitor unit is sending a DHCP request of 319 bytes, where a standard length DHCP Request packet should be ~324 bytes, as can be seen on the below screen capture.

This valid one was generated from the same SPI Ethernet module as the monitor, (Microchip ENC28J60) connected to an Arduino. Standard example code from the EtherCard library was used to set up the DHCP. The MAC address of the monitor was also cloned to this setup to rule out the possibility of that being the root cause.

My deductive reasoning in this case points to the firmware on the monitor being at fault, rather than the SPI ethernet hardware, or my network hardware. Radu over at uRadMonitor is looking into the firmware being at fault.

Strangely, most routers don’t seem to have an issue with the monitor, as connecting another router on a separate subnet works fine, and Wireshark doesn’t even complain about an invalid DHCP packet, although it’s exactly the same.

As the firmware for the devices isn’t currently available for me to pick apart & see if I can find the fault, it’s up to Radu to get this fixed at the moment.

Now, for a µTeardown:

Here is the monitor, a small aluminium box, with power & network.

Removing 4 screws in the end plate reveals the PCB, with the Geiger-Mueller tube along the top edge. My personal serial number is also on the PCB.
The ethernet module is on the right, with the DC barrel jack.

Here is the bottom of the PCB, with the control MCU & the tiny high voltage inverter for the Geiger tube.

A Closeup of the main MCU, an ATMega328p

Logo

PCB Logo. Very artsy 😉

Posted on November 22, 2014 by The Engineer — 1 Comment

Superhub Buffer Overflow?

While checking my Virgin Media-provided router recently, I came across this in the status page:

According to this, it seems to think it’s been running for a grand total of 44.8 years, without a reboot. I’m pretty certain that DOCSIS didn’t exist that long ago, let alone the hardware itself…
Tech Fail

Posted on December 4, 2012March 27, 2017 by The Engineer — Leave a comment

Site Hosting

There have been quite a few updates to the hosting solution for this site, which is hosted locally in my house, from the above setup, in a small comms rack, to a new 22U half rack, with some hardware upgrades to come.

Core switch here has been removed, with the rest of the core network equipment. The site was kept online by a direct connection into the gateway to the intertubes.

New 22U rack, with the core switch, FC switch & management & monitoring server installed.

As I had no rack rails to start with, the servers were placed on the top of the rack to start off, here is the Dell PowerEdge 860 pfSense core router installed, with the initial switch wiring to get the internal core network back online. This machine load balances two connections for an aggregated bandwidth of 140MB/s downstream & 15MB/s upstream.
The tower server behind is the NAS unit that runs the backups of the main & auxiliary webservers.

Still with no rack kits, all the servers are placed on top of the rack, before final installation. This allows running of the network before the rest of the equipment was installed.

The main server & aux server are HP ProLiant DL380 G3 servers, with redundant network connections.

Still to arrive are the final rack kits for the servers & a set of HP BL20p Blade servers, which will be running the sites in the future.

Stay tuned for more updates as they happen!