PCI Express Throughput

x1 : 0.5GBps (4gbps)

x2 : 1GBps (8gbps)

x4 : 2GBps (16gbps)

x8 : 4GBps (32gbps)

x16: 8GBps (64gbps)

x32: 16GBps (128gbps)

Hacking ASUS WL520GU, Installing openWRT

Last week I tried to hack the Asus WL520GU wifi router, after reading this article - Building a Wifi Radio. Though you do not need to have a serial console to hack it, It makes all the sense to have one, just to know what is going on in your router. I bought some 0.1" male header on-line and soldered in the right place as shown in the mightyOhm article. I hit a road block when i found that i needed a serial driver to connect Asus Router to serial cable.

Router gives out 3.3V TTL signals. Whereas a RS232-serial port needs +/-12V signalling. If you connect a serial cable straight to router's header, it will not work. You need a chip to convert TTL level to RS232 level signals. The article mentioned about driver FTDI-232-3V3 which I could not find on-line in India. I tried this PC-MCU Serial Link (USB) converter, which is available on-line robokits.

This PC-MCU has a Female-header that does not work as signals order is different. You need to solder wires and 0.1" 4pin-female header as per the order given in the mightOhm article. Just leave the VCC pin as the driver chip gets power from USB. Connecting Gnd,Tx,Rx lines is enough to make it work. After you prepare the driver cable and connect to header and other end to USB of your laptop. Device Driver needs to be installed in order for the laptop to recognize the usb device as a serial COM port. After inserting the chord and driver, I get a new COM4 device to work with. I used Putty to connect -115200-8N1.

The mightyOhm article provides a Kamikaze build, Flashing procedure is straight forward. It was simple and trouble free to install kamikaze. Soon I realized that the kamikaze runs old 2.4 kernel. Sure enough, I had to upgrade to Backfire, which i did immediately.

Packet Length Distribution in LAN - II

After running the experiment for about 10 days, the table looks like this...

Pkt Histogram
==============
Length %of total packets
=========================
0-63 21.28
64-127 0.69
128-191 5.43
192-255 0.83
256-319 0.56
320-383 0.03
384-447 0.04
448-511 0.06
512-575 0.07
576-639 0.07
640-703 0.05
704-767 0.05
768-831 0.05
832-895 0.03
896-959 0.04
960-1023 0.03
1024-1087 0.03
1088-1151 0.04
1152-1215 0.04
1216-1279 0.1
1280-1343 0.02
1344-1407 1.42
1408-1471 0.02
1472-1535 69.01

Whats inside UTStarcom's BSNL Branded WA3002GA ADSL2+Router

I have a ADSL modem at my disposal at my office. I am going to test my learnings from my personal Broadcom Beetel router in my home.

This ADSL modem is supplied by BSNL. This device has got 4 LAN Ethernet ports and has a Wifi-AP built in. Wan side, it connects to a ADSL enabled POTS line.

I have logged into GUI. surprise surprise, I saw the exactly the same look and feel of my Airtel -supplied-beetel modem. Of course It shows some wifi menu, vpn config menu and more capable firewall menus. Apart from these same font, same color, same table everything same. I checked the bottom of device, it shows it is made by UTStarcom and manufactured in China. My home modem has No info though. It should be either Beetel modem is also manufactured by UTStarcom OR Broadcom chip vendor has supplied the same code base to these OEMs.

I ventured telent-ing into the box. I see 'some' difference here though. I see fixed menu showing. In my home modem, you have to press ? to get the list of commands supported. I typed 'sh' to get a unrestricted busybox shell -so that is same. Just like beetel modem this box's software bulid doesn't support 'ls' command so used 'echo *' to list the files. Software sports 2.6.8 kernel and gcc version 3.4.2, uClibc library. The software version of the box has 'bsnl' in it. It suggests me that code base for both BSNL and Beetel modems are same and separately built.

The Hardware is has got some more muscle

Wifi Chipset,
4 LAN ports
14MB RAM
3MB Flash

It makes sense as my office is using business class ADSL .

I have one more ADSL+everything kinda box with me. it is imported!! I am going to work on it and make it work with BSNL Line. Hope it works, Watch this space for updates.

Tearing apart ADSL Router - Beetel 110BX1 ADSL Router

Looks like the bcm96338 based modems are widely used by Indian ISPs not just Airtel.Little bit more google helped me break into the box. Thanks to http://www.cyberciti.biz/tips/hacking-beetel-220x-adsl-router-broadcom-bcm6338.html for the tips.

I found 2 major flaws in the ADSL-router software.

Hack#1: In web browser, key in http://192.168.1.1/main.html Bingo! It opens the web interface No Login/Password asked!! Must be a developer's page, overlooked during release!!

Hack#2: After logging in to telnet, type 'sh' it opens helplessly a Busybox shell coming out of the fixed menu, revealing entire system. so much for 'hardening'!!

Tip: there is no ls.use echo * instead.

In the last post I had mentioned that I am going to find our CPU and Linux Info. Once you got the entire shell these are the least of the info you can find.

Just for the record, The system has IPTables and ebtables, runs linux 2.6.8, gcc version 3.4.2. Looks like the vendor has not been spending $$ on software lately.


Syaonara.

Sneak Peek into my ADSL Router - Beetel 110BX1 ADSL Router

I have been using Airtel's DSL connection for some time now. I always wanted to see what the are all the capabilities of my "Modem" sitting on my desktop. The Modem reads Beetel 110Bx1 ADSL2 + Router. Today finally I got down to the device and took a look at the beast.
It is a simple device is running (hardened) Linux.

Hardware
- 6MB RAM
- 1.4MB Flash (fully utilized)
- Broadcom chipset, revealed during telnet login.
BCM96338 ADSL Router
Login:
- Single core CPU
- one RJ45 for LAN and One RJ11 for ADSL input line.

Software
- Telnetd , Login:admin, pwd:password
- Httpd (microhttpd, which is very light weight) Login:admin, pwd:password
All config are possible thru web interface.
- No SSH
- Shell is hardened - exposes very limited set of commands.
- Linux contains bridge utilities(brctl is available) The device is actually 'Bridge'.
- Runs a NAT
- Runs simpler form of ACL on Firewall
- Being Linux, it has QoS which is marking of packets with DSCP Values for selected source/destination IP/Port combination.
- It Also has DMZ and D-NAT.
- DHCP and DynDNS client.
- My modem says it runs "3.12L.01.A2pB023k.d20k_rc2" version.
- NTP Client
- as i suspected it runs Busybox v1.0
- All these are packed in 21 processes! (plus my telnet process)



Considering the software functionality and corresponding hardware muscle, It means there's no flab in system. The developers have definitely done a good job. This box says, it is imported by Bharti Teletech Ltd. Too bad it doesn't show who is the original manufacturer even worse country of origin too.

Kudos, whoever developed this 'Router' which works just fine, doesn't use too much resources and still provides all needed s/w features.

What I do not know now is the CPU speed, make Linux version. Let me see if i can break in and find out this.

Average Ethernet Packet size

As on Y2000, the packet size distribution looked something like this...

Downstream Upstream
---------- -------------
0 - 64 14.68 58.49
65 - 127 13.87 29.73
128 - 255 7.25 1.72
256 - 511 6.44 3.98
512 - 1023 13.59 3.37
1024 - 1518 44.17 2.70

Reported by:
Steve Dispensa
Sr. Network Architect
Sprint Broadband Wireless Group