4 ms·

tl;dr: The Intel Puma 6 and Puma 7 chipsets have a performance issue in a part of the packet processing that is specific to TCP/IP, which went undetected for aw

tl;dr: The Intel Puma 6 and Puma 7 chipsets have a performance issue in a part of the packet processing that is specific to TCP/IP, which went undetected for awhile because "ping" packets are not TCP/IP. Modems that use the affected chipset will have high jitter under load (especially load consisting of many short connections), and will suffer denial of service when sent traffic with many different port numbers. Additionally, under a previous firmware (but according to a commenter on https://www.reddit.com/r/news/comments/7fjvvt/hundreds_of_millions_of_cable_modems_affected_by/ https://www.reddit.com/r/news/comments/7fjvvt/hundreds_of_mi... not on the most recent firmware), a timed process would briefly block throughput every 2 seconds, adding to jitter issues. DSLReports has created a tool which checks for this at http://www.dslreports.com/tools/puma6 http://www.dslreports.com/tools/puma6 .

pingisip 9y ago
icmp is IP
- jlgaddis 9y ago
  ICMP is protocol 1, IP(v4) is protocol 4. ICMP(v4) is carried over IP(v4), but it is not IP.
  - bbayles 9y ago
    This is a bit scrambled. Both IPv4 and IPv6 have a spot in their headers to tell what type of traffic is being carried. This is a 1-byte integer called a protocol number. The TCP protocol is protocol number 6. UDP is 17. ICMP is 1. All are carried over IP. Both IPv4 and IPv6 have another spot in their headers to identify their version. This is where 4 and 6 go, but it's not the same as the protocol number field. Similarly, Ethernet has a protocol identification field, "EtherType." IPv4 is number 2048 (0x0800); IPv6 is 34525 (0x86DD)
    - deleted 9y ago
      [deleted]
  - ZWoz 9y ago
    You are mixing different versioning systems. ICMP is protocol 1 inside Internet Protocol, where TCP is protocol 6 and UDP is 17 [0]. Internet version (as it named in rfc790) is defined with four first bits, numbers 1-3 unassigned and 4 is our IPv4[1] Technically ICMP is layer 4 protocol, but defined as integral part of IP [2] [0] https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers [1] https://tools.ietf.org/html/rfc790 https://tools.ietf.org/html/rfc790 [2] https://tools.ietf.org/html/rfc792 https://tools.ietf.org/html/rfc792
    - deleted 9y ago
      [deleted]
  - deleted 9y ago
    [deleted]
nalllar 9y ago
It initially affected TCP, UDP and ICMP. After a firmware "fix", it doesn't affect ICMP but still affects TCP and UDP.
userbinator 9y ago
Does anyone here know why these modems even care about TCP/IP or ICMP or any other protocol higher than the network and physical layers? I could go read the DOCSIS spec in detail, but thought these operated at a similar layer to Ethernet (OSI layers 1 and 2.)
- revelation 9y ago
  Maybe it does NAT in hardware.
- gricardo99 9y ago
  Most modern networking chips for NICs implement TCP/IP checksum offload, sometimes segmentation/fragmentation offload/reassembly
- rasz 9y ago
  They dont, This TLDR is wrong. Puma 5 shipped with just enough resources for 8 downstream channels. Puma 6 has same resources, but 16 downstream channels. Bottleneck is in hardware accelerating packet decoding/assembly, queue/buffer is too shallow and more packets in flight result in stalls. You can disable this hardware block and magically modem stops being susceptible to DOS, but max throughput goes down to ~60Mbit (opposed to theoretical ~800Mbit with ~2Mbit DOS potential) There are people with Puma 6 with ISP using only 6 downstream channels and their modems work just great. 8 is barely acceptable (even puma 5 has problems on the test and can be DOSed by ~10Mbit), 16 is just plan broken.
  - nalllar 9y ago
    DOCSIS "modems" are layer 3 devices as well actually. The DOCSIS standard requires filtering by IP address and port [1] built in to the modem, instead of at the CMTS. This is back-asswards, as a hacked modem can ignore the filtering, but it's part of the spec. There are multiple sources of jitter in the puma 6/5: more channels = more jitter, more flows = more jitter/complete failure at ~2000 separate active flows in a 1 second period. [1]: http://www.cable-europe.eu/wp-content/uploads/bsk-pdf-manager/2_CM-SP-OSSIV3.0-I15-110623.PDF http://www.cable-europe.eu/wp-content/uploads/bsk-pdf-manage... - Annex F Protocol Filtering (Normative)
snuxoll 9y ago
> and will suffer denial of service when sent traffic with many different port numbers. Yup, I've had this happen WAY to frequently with the DG1670 CableOne forced me to switch to (and I literally have no option for other equipment, they require this specific modem for anyone with a static IP). The modem will literally lose connection and reset itself when under load (which takes upwards of 10 minutes to boot), if I could put my old SBG6850 back in place I would do so in a heartbeat.
vitus 9y ago
I was under the impression that most rigorous network measurement tests used TCP (e.g. traceroute -T) because it was well-known that routers and other network devices along the path often had a separate fastpath for ICMP traffic.

pingisip 9y ago

icmp is IP

jlgaddis 9y ago
ICMP is protocol 1, IP(v4) is protocol 4. ICMP(v4) is carried over IP(v4), but it is not IP.
- bbayles 9y ago
  This is a bit scrambled. Both IPv4 and IPv6 have a spot in their headers to tell what type of traffic is being carried. This is a 1-byte integer called a protocol number. The TCP protocol is protocol number 6. UDP is 17. ICMP is 1. All are carried over IP. Both IPv4 and IPv6 have another spot in their headers to identify their version. This is where 4 and 6 go, but it's not the same as the protocol number field. Similarly, Ethernet has a protocol identification field, "EtherType." IPv4 is number 2048 (0x0800); IPv6 is 34525 (0x86DD)
  - deleted 9y ago
    [deleted]
- ZWoz 9y ago
  You are mixing different versioning systems. ICMP is protocol 1 inside Internet Protocol, where TCP is protocol 6 and UDP is 17 [0]. Internet version (as it named in rfc790) is defined with four first bits, numbers 1-3 unassigned and 4 is our IPv4[1] Technically ICMP is layer 4 protocol, but defined as integral part of IP [2] [0] https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers [1] https://tools.ietf.org/html/rfc790 https://tools.ietf.org/html/rfc790 [2] https://tools.ietf.org/html/rfc792 https://tools.ietf.org/html/rfc792
  - deleted 9y ago
    [deleted]
- deleted 9y ago
  [deleted]

nalllar 9y ago

It initially affected TCP, UDP and ICMP. After a firmware "fix", it doesn't affect ICMP but still affects TCP and UDP.

userbinator 9y ago

Does anyone here know why these modems even care about TCP/IP or ICMP or any other protocol higher than the network and physical layers? I could go read the DOCSIS spec in detail, but thought these operated at a similar layer to Ethernet (OSI layers 1 and 2.)

revelation 9y ago
Maybe it does NAT in hardware.
gricardo99 9y ago
Most modern networking chips for NICs implement TCP/IP checksum offload, sometimes segmentation/fragmentation offload/reassembly
rasz 9y ago
They dont, This TLDR is wrong. Puma 5 shipped with just enough resources for 8 downstream channels. Puma 6 has same resources, but 16 downstream channels. Bottleneck is in hardware accelerating packet decoding/assembly, queue/buffer is too shallow and more packets in flight result in stalls. You can disable this hardware block and magically modem stops being susceptible to DOS, but max throughput goes down to ~60Mbit (opposed to theoretical ~800Mbit with ~2Mbit DOS potential) There are people with Puma 6 with ISP using only 6 downstream channels and their modems work just great. 8 is barely acceptable (even puma 5 has problems on the test and can be DOSed by ~10Mbit), 16 is just plan broken.
- nalllar 9y ago
  DOCSIS "modems" are layer 3 devices as well actually. The DOCSIS standard requires filtering by IP address and port [1] built in to the modem, instead of at the CMTS. This is back-asswards, as a hacked modem can ignore the filtering, but it's part of the spec. There are multiple sources of jitter in the puma 6/5: more channels = more jitter, more flows = more jitter/complete failure at ~2000 separate active flows in a 1 second period. [1]: http://www.cable-europe.eu/wp-content/uploads/bsk-pdf-manager/2_CM-SP-OSSIV3.0-I15-110623.PDF http://www.cable-europe.eu/wp-content/uploads/bsk-pdf-manage... - Annex F Protocol Filtering (Normative)

snuxoll 9y ago

> and will suffer denial of service when sent traffic with many different port numbers. Yup, I've had this happen WAY to frequently with the DG1670 CableOne forced me to switch to (and I literally have no option for other equipment, they require this specific modem for anyone with a static IP). The modem will literally lose connection and reset itself when under load (which takes upwards of 10 minutes to boot), if I could put my old SBG6850 back in place I would do so in a heartbeat.

vitus 9y ago

I was under the impression that most rigorous network measurement tests used TCP (e.g. traceroute -T) because it was well-known that routers and other network devices along the path often had a separate fastpath for ICMP traffic.