6 ms·

I think generally you don't get a choice when it comes to DOCSIS equipment. You can't just connect up your own (or at least no to Virgin Media's network)

deanclatworthy 5y ago
You can take those routers and use it as a modem only. Then put your own router in front of it.
- buggeryorkshire 5y ago
  It's still not really modem-only mode. They do routing in there, mainly for their management layer.
  - Semaphor 5y ago
    I must admit, I don’t know much about networking. But do you have some more information there? My German cable router is in modem-mode, and I’d be interested in knowing what kind of routing it still does.
    - lxgr 5y ago
      DOCSIS networks usually assign some management IP address that the provider can access to perform remote diagnostics on the modem directly. It's usually invisible and inaccessible to the user. Also, in many cases there is a specific that the "modem" listens on, serving a web interface that allows switching back to "router" mode. This also wouldn't be possible with a "pure" modem (as it shouldn't have any concept of the IP layer).
      - Semaphor 5y ago
        That makes sense. After all, I weirdly had to use their webinterface to even put it into modem mode. Thanks. Though now that I’m thinking of it, are you sure it uses IP? It’s not as if they can’t use other layers.
        LilBytes 5y ago
        Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/ https://volpefirm.com/docsis-3-0-cable-modem-registration/
        dangerface 5y ago
        Virgin used to just use the mac address with their old modems, you could flash the firmware and change the mac so you could buy their cheapest package and flash the mac of a modem with unlimited gbit internet. They craked down on that a few years ago tho so I don't think this is possible anymore.
        lxgr 5y ago
        Modern DOCSIS also uses certificate-based authentication. Only the owner of a given MAC OUI is able to create a certificate covering MACs under it that will be accepted by the CMTS.
        lxgr 5y ago
        Registration/network access and management are two different things, no?
        LilBytes 5y ago
        Not always, with Telstra the MAC address was also responsible for authentication. Though I believe it's since changed, my last interaction with DOCSIS was 4-5 years ago. I seem to recall there's a captive portal involved now but previously it was solely MAC.
      - thrashh 5y ago
        Note that even many actual DOCSIS modems have management interfaces and are not pure. I have always been able to view the management page for my Arris/Motorola Surfboard modems.
  - gruez 5y ago
    But that's fine right? If your ISP wants to send you bad packets having your own equipment isn't going to stop them either
- kevin_thibedeau 5y ago
  Which then burdens you with a double NAT which shouldn't ever be necessary if the industry had their shit together.
  - nly 5y ago
    No you don't. In modem mode the VM routers only issue a single IP (the internet facing IP) over DHCP to a single host (your router)
    - guipsp 5y ago
      Fwiw not all modems support this (and some do but the ISPs disable it).
  - mugsie 5y ago
    Virgin Media allows you to use "modem mode" on their service, which is great, because it also turns off the CGNat crap, and gives you a real IPv4 address via DHCP on your own equipment
- stordoff 5y ago
  I haven't tried it myself, but this chain of comments at /r/netsec[1] suggests it doesn't help: > I'm guessing a workaround is to use a 3rd party router and block traffic to 192.168.100.1 which is the IP of the management UI when in modem only mode, presumably the external IP can still be retrieved in modem only mode > If it's still active in modem-only mode, it essentially precludes use of these routers entirely for any sensitive comms. > The web interface is still available in bridge mode with Liberty Global's Arris modems, yes. > Just tried it on my device in modem-mode and it does indeed still expose the snmpGet endpoint. As suggested above, i've firewalled all traffic to 192.168.100.1 on my own firewall. [1] https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unmasking_virgin_media_vpn_users_in/ https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unm...
saurik 5y ago
(I bought my DOCSIS 3.whatever cable modem to use with Cox Cablevision myself at Best Buy after deciding which one I thought would be the best.)
- hellbannedguy 5y ago
  Bestbuy likes to push the $300 modems. They do carry a $69 one on the bottom shelf, if it's stocked.
  - saurik 5y ago
    I didn't ask Best Buy which one they wanted to sell me... I simply bought one at Best Buy explicitly after deciding which one would be the best (and I had to drive two hours to find a Best Buy that carried it).
- Crosseye_Jack 5y ago
  In the UK, Virgin Media (The biggest cable provider, I think there maybe a couple of minor regional cable providers still dotted around the country) are the largest cable provider after buying up the smaller regional companies (My regional provider was brought up by Telewest). Long story short, their was tons of regional providers, they were brought up by one of two players which basically devided the country into being served by either NTL or Telewest, NTL and Telewest then merged becoming NTL:Telewest, who then brought Virgin Mobile (an MVNO in the UK) to become a 4 way provider (TV, Phone, Internet and now Mobile). Virgin Media are now owned by a US conpany, Liberty Global iirc) Neither NTL nor Telewest allow consumer owned equipment onto their cable internet network, heck I remember Telewest only authing one consumer device mac address to be connected to their modems at the start of their cable internet rollout (so if you wanted to use your own router conencted to the modem, you would either have to give Telewest the mac address of the router or set the mac address of the WAN port to the mac address of the computer that was initially conencted to their network (which was the quickest option, you could never get them to swap it instantly over the phone, but could doing business hours over telewests newsgroups as their engineers would hang out their, which used to be the quickest way to get your line serviced if their was ever an issue), a practice telewest did drop before they merged with NTL. NTL never had such a policy iirc, but I only lived in an NTL area for a couple of years). Their modem secuirty has never been "great". For the longest time (since creation till only a few years ago) you were able to get free internet if you cloned the mac address of someone elses modem but used it in a differnt area, mac addresses that could be captured by any modem (provisioned or not) connected to the network. So there used to be mac swapping forums where X would scan and log their area can trade with Y who would to the same in theirs (used to be handy when they had "fair usage" trottling enabled, used your download limit for the day, swap your mac and get a new limit, or if you wanted to run a 2nd/3rd/4th modem, but that would be naughty... So I never did such a thing. IIRC: Modem cloning is still possible today, but you need to get the certs from a provisioned modem, so its not as simple as just sniffing mac address from the cable line as other modems register on the network). Here in the UK, we have always been limited to the modem the cable company provided, which remained their property (both were often uncollected by the company when a customer left, so you could easily find old modems on ebay for pennies on the pound, which just happened to have thier unsigned firmware (and mac addresses) on SPI flash if you wished to tinker with them), which for 99% of the UK was fine, as it was common (and still is) to just used what ever device was issued to you. Atleast with ADSL/VDSL in the UK you are free to use what ever device you wanted (except for Sky, they used to be PITAs about getting the auth details to run your own modem, but once you did and aslong as your modem supported their auth (which isn't the auth used by most of the xDSL providers in the UK) you were free to use your own equipment, just "unsupported" so if you had issues on your line, it was best to connect their modem to the line before calling customer services.
treesknees 5y ago
This is one of the few positives I'll give to Comcast/Xfinity. I'm able to purchase my own DOCSIS modem (as long as it's on their compatibility list) instead of renting one from them. AT&T U-verse I couldn't bring my own modem, and I understand that they're not a DOCSIS network either.
- mikepurvis 5y ago
  Rogers network in Canada also permits BYO— I've used my own modem for years as a TekSavvy cable customer, and recently upgraded from one owned modem to another (both purchased second hand, though, so who knows— maybe I've been pwnt all along).
- InitialLastName 5y ago
  With Optimum (nee Cablevision) they pretend to be BYO accessible, but their compatibility list isn't a guarantee of compatibility (depending on region, different devices are compatible but they would never tell you that on their website), you have to wait on hold for 3 hours to activate the device, and then it still might fail for reasons their support agents can never explain.
- lebrad 5y ago
  Comcast makes you downgrade to a business account if you want to get a reverse DNS entry from them. Reverse DNS is a requirement if you want to host your own e-mail and not have your mail categorized as spam. Comcast business accounts don't allow you to use your own DOCSIS modem.
  - joecool1029 5y ago
    >Comcast business accounts don't allow you to use your own DOCSIS modem. Not true. I have multiple business locations using customer owned surfboards. Might be a requirement for static addresses but it's not for business service in general.
    - ArchOversight 5y ago
      You only need their Comcast Business modem if you have static IP's because they route them using RIP with a password that is set inside the cable modem with their custom software. If you don't have a static IP with Comcast Business it makes it awfully hard to run a mail server, but then you can indeed use your own cable modem.
myself248 5y ago
I brought my own modem to WideOpenWest, and it wasn't even on the compatibility list. Just gave them the MAC, and a few moments later I had DHCP. Been solid for 9 years now. Although as of a few weeks ago, WOW has announced bandwidth caps, so I have to rescind my former glowing recommendation. Le sigh.
- dangerface 5y ago
  Looks like they don't offer services in the UK.
AlpineG 5y ago
Virgin Arris routers can be put in modem mode you put your own router behind it. I guess this solves most shortcomings and security issues.

deanclatworthy 5y ago

You can take those routers and use it as a modem only. Then put your own router in front of it.

buggeryorkshire 5y ago
It's still not really modem-only mode. They do routing in there, mainly for their management layer.
- Semaphor 5y ago
  I must admit, I don’t know much about networking. But do you have some more information there? My German cable router is in modem-mode, and I’d be interested in knowing what kind of routing it still does.
  - lxgr 5y ago
    DOCSIS networks usually assign some management IP address that the provider can access to perform remote diagnostics on the modem directly. It's usually invisible and inaccessible to the user. Also, in many cases there is a specific that the "modem" listens on, serving a web interface that allows switching back to "router" mode. This also wouldn't be possible with a "pure" modem (as it shouldn't have any concept of the IP layer).
    - Semaphor 5y ago
      That makes sense. After all, I weirdly had to use their webinterface to even put it into modem mode. Thanks. Though now that I’m thinking of it, are you sure it uses IP? It’s not as if they can’t use other layers.
      - LilBytes 5y ago
        Can't speak for all Telco's but in Australia, DOCSIS modems are registered by their MAC address on the modem it's self. Not by IP address. I can't imagine this is different else where so it's likely the replying comment above yours is incorrect. Source: I was previously a network engineer for a national Telco. Other sources: DOCSIS 3.0 registration info: https://volpefirm.com/docsis-3-0-cable-modem-registration/ https://volpefirm.com/docsis-3-0-cable-modem-registration/
        dangerface 5y ago
        Virgin used to just use the mac address with their old modems, you could flash the firmware and change the mac so you could buy their cheapest package and flash the mac of a modem with unlimited gbit internet. They craked down on that a few years ago tho so I don't think this is possible anymore.
        lxgr 5y ago
        Modern DOCSIS also uses certificate-based authentication. Only the owner of a given MAC OUI is able to create a certificate covering MACs under it that will be accepted by the CMTS.
        lxgr 5y ago
        Registration/network access and management are two different things, no?
        LilBytes 5y ago
        Not always, with Telstra the MAC address was also responsible for authentication. Though I believe it's since changed, my last interaction with DOCSIS was 4-5 years ago. I seem to recall there's a captive portal involved now but previously it was solely MAC.
    - thrashh 5y ago
      Note that even many actual DOCSIS modems have management interfaces and are not pure. I have always been able to view the management page for my Arris/Motorola Surfboard modems.
- gruez 5y ago
  But that's fine right? If your ISP wants to send you bad packets having your own equipment isn't going to stop them either
kevin_thibedeau 5y ago
Which then burdens you with a double NAT which shouldn't ever be necessary if the industry had their shit together.
- nly 5y ago
  No you don't. In modem mode the VM routers only issue a single IP (the internet facing IP) over DHCP to a single host (your router)
  - guipsp 5y ago
    Fwiw not all modems support this (and some do but the ISPs disable it).
- mugsie 5y ago
  Virgin Media allows you to use "modem mode" on their service, which is great, because it also turns off the CGNat crap, and gives you a real IPv4 address via DHCP on your own equipment
stordoff 5y ago
I haven't tried it myself, but this chain of comments at /r/netsec[1] suggests it doesn't help: > I'm guessing a workaround is to use a 3rd party router and block traffic to 192.168.100.1 which is the IP of the management UI when in modem only mode, presumably the external IP can still be retrieved in modem only mode > If it's still active in modem-only mode, it essentially precludes use of these routers entirely for any sensitive comms. > The web interface is still available in bridge mode with Liberty Global's Arris modems, yes. > Just tried it on my device in modem-mode and it does indeed still expose the snmpGet endpoint. As suggested above, i've firewalled all traffic to 192.168.100.1 on my own firewall. [1] https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unmasking_virgin_media_vpn_users_in/ https://www.reddit.com/r/netsec/comments/pnzs0n/silently_unm...

saurik 5y ago

(I bought my DOCSIS 3.whatever cable modem to use with Cox Cablevision myself at Best Buy after deciding which one I thought would be the best.)

hellbannedguy 5y ago
Bestbuy likes to push the $300 modems. They do carry a $69 one on the bottom shelf, if it's stocked.
- saurik 5y ago
  I didn't ask Best Buy which one they wanted to sell me... I simply bought one at Best Buy explicitly after deciding which one would be the best (and I had to drive two hours to find a Best Buy that carried it).
Crosseye_Jack 5y ago
In the UK, Virgin Media (The biggest cable provider, I think there maybe a couple of minor regional cable providers still dotted around the country) are the largest cable provider after buying up the smaller regional companies (My regional provider was brought up by Telewest). Long story short, their was tons of regional providers, they were brought up by one of two players which basically devided the country into being served by either NTL or Telewest, NTL and Telewest then merged becoming NTL:Telewest, who then brought Virgin Mobile (an MVNO in the UK) to become a 4 way provider (TV, Phone, Internet and now Mobile). Virgin Media are now owned by a US conpany, Liberty Global iirc) Neither NTL nor Telewest allow consumer owned equipment onto their cable internet network, heck I remember Telewest only authing one consumer device mac address to be connected to their modems at the start of their cable internet rollout (so if you wanted to use your own router conencted to the modem, you would either have to give Telewest the mac address of the router or set the mac address of the WAN port to the mac address of the computer that was initially conencted to their network (which was the quickest option, you could never get them to swap it instantly over the phone, but could doing business hours over telewests newsgroups as their engineers would hang out their, which used to be the quickest way to get your line serviced if their was ever an issue), a practice telewest did drop before they merged with NTL. NTL never had such a policy iirc, but I only lived in an NTL area for a couple of years). Their modem secuirty has never been "great". For the longest time (since creation till only a few years ago) you were able to get free internet if you cloned the mac address of someone elses modem but used it in a differnt area, mac addresses that could be captured by any modem (provisioned or not) connected to the network. So there used to be mac swapping forums where X would scan and log their area can trade with Y who would to the same in theirs (used to be handy when they had "fair usage" trottling enabled, used your download limit for the day, swap your mac and get a new limit, or if you wanted to run a 2nd/3rd/4th modem, but that would be naughty... So I never did such a thing. IIRC: Modem cloning is still possible today, but you need to get the certs from a provisioned modem, so its not as simple as just sniffing mac address from the cable line as other modems register on the network). Here in the UK, we have always been limited to the modem the cable company provided, which remained their property (both were often uncollected by the company when a customer left, so you could easily find old modems on ebay for pennies on the pound, which just happened to have thier unsigned firmware (and mac addresses) on SPI flash if you wished to tinker with them), which for 99% of the UK was fine, as it was common (and still is) to just used what ever device was issued to you. Atleast with ADSL/VDSL in the UK you are free to use what ever device you wanted (except for Sky, they used to be PITAs about getting the auth details to run your own modem, but once you did and aslong as your modem supported their auth (which isn't the auth used by most of the xDSL providers in the UK) you were free to use your own equipment, just "unsupported" so if you had issues on your line, it was best to connect their modem to the line before calling customer services.

treesknees 5y ago

This is one of the few positives I'll give to Comcast/Xfinity. I'm able to purchase my own DOCSIS modem (as long as it's on their compatibility list) instead of renting one from them. AT&T U-verse I couldn't bring my own modem, and I understand that they're not a DOCSIS network either.

mikepurvis 5y ago
Rogers network in Canada also permits BYO— I've used my own modem for years as a TekSavvy cable customer, and recently upgraded from one owned modem to another (both purchased second hand, though, so who knows— maybe I've been pwnt all along).
InitialLastName 5y ago
With Optimum (nee Cablevision) they pretend to be BYO accessible, but their compatibility list isn't a guarantee of compatibility (depending on region, different devices are compatible but they would never tell you that on their website), you have to wait on hold for 3 hours to activate the device, and then it still might fail for reasons their support agents can never explain.
lebrad 5y ago
Comcast makes you downgrade to a business account if you want to get a reverse DNS entry from them. Reverse DNS is a requirement if you want to host your own e-mail and not have your mail categorized as spam. Comcast business accounts don't allow you to use your own DOCSIS modem.
- joecool1029 5y ago
  >Comcast business accounts don't allow you to use your own DOCSIS modem. Not true. I have multiple business locations using customer owned surfboards. Might be a requirement for static addresses but it's not for business service in general.
  - ArchOversight 5y ago
    You only need their Comcast Business modem if you have static IP's because they route them using RIP with a password that is set inside the cable modem with their custom software. If you don't have a static IP with Comcast Business it makes it awfully hard to run a mail server, but then you can indeed use your own cable modem.

myself248 5y ago

I brought my own modem to WideOpenWest, and it wasn't even on the compatibility list. Just gave them the MAC, and a few moments later I had DHCP. Been solid for 9 years now. Although as of a few weeks ago, WOW has announced bandwidth caps, so I have to rescind my former glowing recommendation. Le sigh.

dangerface 5y ago
Looks like they don't offer services in the UK.

AlpineG 5y ago

Virgin Arris routers can be put in modem mode you put your own router behind it. I guess this solves most shortcomings and security issues.