In this article, we are going to closely examine the cable modem registration
process, break it down into its fundamental parts and understand how it should
work. We will then look at the registration process as seen from the RF plant
using a Data Over Cable Service Interface Specification (DOCSIS) protocol
analyzer (DPA). Finally, we will discuss some common nonRF DOCSIS and Internet
protocol (IP) problems that can be identified readily with a DPA.
Cable modem registration
All cable modems are simple devices, which means they are easy to
troubleshoot once you understand how they work. The subscriber buys a cable
modem, registers it with the local cable system, connects the RF coax and plugs
in the power. The following are steps the cable modem should follow.
Downstream Frequency Search: The cable modem scans the downstream looking for
64- or 256-QAM (quadrature amplitude modulation) digitally modulated signals.
Once a digital signal is found, the modem looks for information on that signal
that is sent by the cable modem termination system (CMTS). A critical piece of
information is the upstream channel descriptor (UCD), which contains information
that the cable modem will need, such as the upstream frequency, modulation type
and channel bandwidth to use in order to communicate with the CMTS.
Ranging: Once the cable modem has found the digital signal from the CMTS
(remember, there are digital video signals on the downstream, too), the cable
modem will listen for a special message from the CMTS called a map. The map will
give the cable modem an opportunity to transmit upstream data for the first time
(initial maintenance). Since the cable modem doesn't know what RF transmit power
to use, it will start at its lowest power (+8 dBmV). If the CMTS does not
respond, the modem will increase its transmit power by 3 dB and try again. The
message being sent is called a range request. The cable modem keeps increasing
the transmit power of the range request until the CMTS is able to detect the
range request. Once the CMTS detects the range request, it analyzes the power,
frequency and timing of the range request and sends the cable modem a range
response, which includes instructions for the modem to adjust its transmit
power, frequency and timing as necessary.
The CMTS does this ranging (station maintenance) for every cable modem in the
DOCSIS network at least once every 30 seconds. This ensures that all cable
modems are transmitting at the proper power, frequency and timing.
Dynamic host configuration protocol (DHCP): Now that the cable modem has
ranged with the CMTS, it has established a communications link. It must now
obtain additional information about the network, get an IP address and get the
name of a configuration file. This is all achieved by using DHCP. This is a
four-step process in which the cable modem sends a DHCP discover message to a
DHCP server connected to the IP network attached to the CMTS. If the cable modem
has been provisioned on the server, the DHCP server will send the modem an IP
address, the IP addresses of other important network servers and the
Time of Day (ToD): Although a requirement for DOCSIS 1.0 networks, the ToD
server, which provides a timestamp to cable modems during registration, is
actually no longer required in DOCSIS 1.1 and later revisions. Almost all modems
will in fact boot without a functioning ToD server.
Trivial file transfer protocol (TFTP): Next, the cable modem must download
the configuration file whose name it was given during the DHCP process. It does
this by sending a TFTP read request to the IP address of the TFTP server, also
obtained during the DHCP process. If the filename exists on the TFTP server, the
file is downloaded to the cable modem. This file will provide the cable modem
with settings such as the maximum subscriber data download and upload speeds,
quality of service (QoS) settings, DOCSIS 1.1 settings, encryption settings,
Registration request: Finally, the cable modem will send a registration
request to the CMTS along with a list of the modem's configuration settings. If
the CMTS approves of the modem's settings, it will respond with a registration
response indicating a successful registration. If the CMTS does not like the
cable modem's settings, the CMT
S has the ability to reject the cable modem with
a registration rejection, and the cable modem will not be able to come online
and transmit data.
Baseline privacy infrastructure (BPI/BPI+, optional): BPI is being
implemented by many cable operators, both as a means to encrypt and protect
subscriber data while it is on the RF network and also as a way to prevent
nonpaying subscribers from getting broadband service with hacked cable modems.
The BPI registration process, when enabled, occurs immediately after the cable
modem registers with the CMTS. BPI is a four-step process at which time public
and private keys are exchanged between the cable modem and CMTS, along with key
Let us summarize the six-step (seven with optional BPI) process:
This is what the process looks like (see Figure 1 on page 66) from the
perspective of a DPA.
Step 1, the downstream search, is a passive process conducted by the cable
modem. This is not something that would be observable by a DPA. The first thing
that can be seen by the DPA is Step 2, ranging.
Frame 1 at time 0.00000 seconds, from source media access control (MAC)
address 00:eo:6f:58:79:52 (the cable modem), communicates to the destination MAC
address, at 00:50:57:00:2b:e6 (the CMTS), a DOCSIS protocol management message
that is of type Initial Ranging Request. So this is the first time the CMTS (and
the DPA) is able to hear a message from the cable modem. Since the service
identifier (SID) of the cable modem is equal to zero, this is also an indicator
that the cable modem has not been assigned a SID by the CMTS, so it is using the
default SID=0. Frame 2 is the range response from the CMTS, which contains
adjustments for the cable modem in order to adjust its transmitting power,
frequency and timing. (These values are observable by examining the details of
any of the captured data above.) The cable modem must make two more range
requests in Frames 3 and 5, with corresponding range responses in Frames 4 and 6
before it is transmitting at the proper levels. Now it can move on to Step 3,
Frames 11 through 14 show the DHCP process. First, the cable modem sends a
DHCP discover. This message is relayed to the DHCP server by the CMTS. The DHCP
server responds with a DHCP offer, providing the cable modem with all of the
necessary details. The cable modem responds with a DHCP request, confirming the
information received, which is then acknowledged by the DHCP server via a DHCP
acknowledgement (ACK). Now the cable modem can move on to Step 4, ToD.
Frames 17 and 20 show the cable modem requesting a ToD stamp from the ToD
server and then receiving the response from the ToD server. If a modem does not
immediately receive a ToD response, it will automatically move on to Step 5,
Unlike ToD, TFTP cannot fail. The filename provided during DHCP is now
requested for download from the TFTP server by the cable modem, as shown in
Frame 23. The TFTP server will initiate a download to the cable modem (Frame
24), and the modem will acknowledge the download if it is free of errors (Frame
Finally, the modem can register with the CMTS, Step 6. Frame 26 shows the
registration request sent to the CMTS by the cable modem. This registration
request contains important information about the modem that the CMTS will
inspect. Frame 27 shows the registration response from the CMTS with the words
(OK/success) at time 1.549170 seconds. The cable modem registers with the CMTS
in less than 2 seconds. Much of the time spent waiting for a cable modem to
register with a CMTS is during Step 1, the downstream search. Once the modem is
locked to the downstream, the rest of the process is lightning fast—unless you
have problems with your DOCSIS or IP network ....
So, what can go wrong?
Of the nonRF problems we see in the field affecting subscribers, about 90
percent are IP-related, and 10 percent are DOCSIS-related.
Here is a short list of very common problems.
The cable modem registration process is very straightforward and consists of
six basic steps. This process should be committed to memory and understood
whether you are a line tech or a plant manager for the simple fact that DOCSIS
is rapidly becoming the bread and butter of the cable industry. Once you have a
solid foundation of the cable modem-CMTS intricacies, then you'll be ready to
move on to the multimedia terminal adapter (MTA), which is required for voice
over IP (VoIP).
We now have the tools, the knowledge of how the cable modems register, and a
basic understanding of the most common problems. Identifying these problems when
they occur is usually intuitive, such as in the example of Figure 2 (on page
66). Frame 19 shows a cable modem in the middle of Step 5, TFTP, when it
receives an Error Code: File not found to its TFTP read request in Frame 12.
This could be dealt with either via hours of RF troubleshooting or by a simple
file analysis with a DPA, resulting in a quick diagnosis of the problem.