Post a video on YouTube and it will be featured here!
Do you have a brand new device you want me to hack?
Send it to me!
Are you producing a device and want me to check it's security?
Send me an email!
As of now more than 3500 people unlocked Huawei E585, E5830,
E5832S, E583C and HW-01C successfully!

Friday, February 27, 2009

Unleash your ADSL horses!

Hello! I just made a discovery I want to share with you:
As a few of you may know, on broadcom based adsl modems/routers there is a command line utility which allows to tweak the adsl physical connection.
This command is adslctl and accepts many parameters.
One of them is SNR which is used to force a lower (or higher) SNR.
On the information page you will see that there is a maximum speed achievable on your own line due to noise, distance and quality and then you read the actual connection speed.
An example:
Max(Kbps): 18420 1027
Rate (Kbps): 17972 1013
If you issue the command
adslctl configure --snr 1
You are telling the modem to set the minimum SNR
(it may not give you any performance improves on a very noisy line)
thus allowing the modem to 'hook' at higher speed.
Since my line performed very well with snr=1 I wondered if it could be possible to lower the snr below 1. Then I thought that the variable used in the code is a signed WORD so
since a negative value is not possible why not trying an overflow ?
adslctl configure --snr 65440
This corresponds to -106 and it proved to be the best value on my line.
Now my connection details are:
Max(Kbps): 17740 1027
Rate (Kbps): 22237 1027
Yes! You read it right!
You can try values from 65400 to 65500.
Don't push the lower or the line will be so noisy that the remote dslam will degradate it's connection parameters and it will take long to come back to normal without a dslam reset!
Some stats:
Completed 698.82 M
Total Time 00:05:16
Average Speed 2264.53 KB/s
$ wget -O /dev/null
Length: 13,477,400 (13M) [text/plain]
100%[====================================>] 13,477,400 2.25M/s ETA 00:00


Cristian Vidaechea said...

Hi Zibri, I've been intrigue ever since I saw this, but I dont have ADSL, just cable, its there a way to do this on cable?

thanks for the hard work!!!


Matt Yorke said...

I believe there used to be a way to force old style (motorola surfboard) cable modems to give higher speeds by running your own tftp server on the same IP as the providers tftp server, then pinging from your tftp server - the modem then assumed this was the "correct" tftp server and downloaded configuration info from your server instead of the providers. I don't whether the more modern cable modems use the same configuration method.

iLeW said...

Hi Zibri, well that is a unix command line, how can i use that line on windows?
Thank you.

(Ciao Zibri, ho un moden broadcom, e volevo provare a usare la tua command line per l'SNR, come posso usarla su Windows 7? Grazie )

Cisneiros said...

Same question as Frederico... any way to do it on Windows?

Unknown said...

It's the router that's basically running a linux system... you run commands from a telnet client (Putty in Windows). You'll need of course to open/hack the telnet port.

Anyway this suggestion let me get a full 8000 Mbs from 6500 Mbs at best! Option "mod" set to "d" G.DMT was useful too.

Thanks Zibri!!!

Zibri said...

hmm the modulation should not change anything since it's the dslam that set it.

g.dmt is the ADSL standard (till 8mb/s)

if you want to see the real speed between your router and the dslam you can do:

adslctl bert --start 16

then after 16 seconds:

adslctl --show

then you get the hex number of bits tested and divide by 16
that's the real speed you have.
Everything else slowing you is you pc comfiguration and your provider greed :)

Unknown said...

Don't know why, but it seems that if I let it sync with Adsl2 modulation, the speed will be lower. It might have been just bad luck with my test; "snr" is the setting that changed the game.

Post a Comment