ISP SFP GPON in HEX S

tzaman · Sat May 02, 2020 3:46 pm

So, my ISP has provided me with a Fritzbox 5491, which I absolutely hate, so I've set myself on a mission to get rid of it.

The only good part about it is that it comes with a proper SFP GPON module (Cigtech G-95SP), which can be pulled out of the device and inserted into my Mikrotik hex S.

But it does not work, and I know why, just not sure how to solve it.

The thing is that the module has no serial number on itself, so the OLT doesn't let it online. The way that Fritzbox does it, it makes a TCP request to the module's IP address (which I've discovered with Wireshark, and in my case, it's 192.168.47.1) and in the payload, the serial number is transmitted over to the GPON, which then is allowed online by the OLT.

I can confirm my ISP uses Serial Number authentication because I also tried flashing Unifi Nano G with the serial from Fritzbox and it gets online (but has other issues).

So of course the next step for me was to try and navigate (in browser) to the IP of the SFP module, but it refuses the connection outright.

And now I'm here, looking for suggestions and the question whether anyone has attempted the same thing and if they had any luck?

Thanks!

msatter · Mon May 04, 2020 6:26 pm

If you search for the word "spain" here you will find a lot postings about gpon andaccess.

JeanPierre · Mon May 04, 2020 8:14 pm

See what you get when you put the module in the Mikrotik router. Wait up to 2 minutes for results.

[admin@MikroTik] > interface ethernet monitor sfp1

tzaman · Wed May 06, 2020 11:15 am

See what you get when you put the module in the Mikrotik router. Wait up to 2 minutes for results.
Code: Select all
[admin@MikroTik] > interface ethernet monitor sfp1

Already did that, the problem is that sfp-vendor-serial field is empty. I actually got a dump from Fritzbox's dmesg, and I can see there's a process in it that updates GPON serial at device boot. The only problem is I can't see the source code of that process.

Here's the relevant log part:

[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_get_cmd_pipe_from_daemon: Daemon is not running
[AVM2FIBER MAIN][INFO]Start deamon now
[AVM2FIBER MAIN][INFO]Start as daemon
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_pollEvent: connection with SFP established.
[AVM2FIBER MAIN][WARN]avm2fiber_xdsld_check_sfpconnection: Failed to connect with outbound socket.
[AVM2FIBER MAIN][WARN]avm2fiber_xdsld_check_sfpconnection: Failed to connect with inbound socket.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_check_sfpconnection: connection with outbound socket succeeded.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_check_sfpconnection: connection with inbound socket succeeded.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: initializing SFP
[AVM2FIBER MAIN][INFO]avm2fiber_msb__check_firmware: Firmware version on sfp module is FRITZ_SFP_FW_rel_1.3.26. Host fw version is FRITZ_SFP_FW_rel_1.3.26.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: firmware version on sfp module ok!   
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_sendIfaceStatusNotify: trigger IFACE_STATUS_NOTIFY status=0
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: SFP initilized succesfully.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Version Number (String)=
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Vendor Serial Number (String)= 444E6DXXXXXX F!Box5491 171.07.12
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Vendor ID (String)= <0x04>
[AVM2FIBER MAIN][INFO]setting equid F!Box5491
[AVM2FIBER MAIN][INFO]setting version 07.12_1.3.26
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: zero password length. Clearing password!
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: setting serial and pw!
[AVM2FIBER MAIN][INFO]avm2fiber_msb__set_gsn: setting gpon serial to AVMG62XXXXXX successful
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: Now sending!
[AVM2FIBER MAIN][INFO]< AVMEVENT: 5 | mode: FIBER | US rate: 0 | DS rate: 0 | Reason flags: 0x00000000 >
[AVM2FIBER MAIN][INFO]< AVMEVENT: 6 | mode: FIBER | US rate: 1000000 | DS rate: 1000000 | Reason flags: 0x00000000 >
[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_client_mode_send_cmd_to_daemon: print supportdata to stdout    
[AVM2FIBER MAIN][INFO]main: program terminate not running as a daemon (clientMode)
[AVM2FIBER MAIN][INFO]started..

I was hoping Mikrotik maybe has some utility to "talk to SFP" modules.

msatter · Wed May 06, 2020 1:46 pm

Spain: viewtopic.php?f=3&t=116364&p=789506&hilit=spain#p762916

It is not the solution but a start for you.

JeanPierre · Wed May 06, 2020 8:05 pm

Not much information on the SFP module manufacturer's website.
https://www.cigtech.com/product_portfol ... spg-97s-2/

This module is probably a GPON ONU that relies on the Frizbox's host CPU to perform heavy lifting.

[AVM2FIBER MAIN][INFO]avm2fiber_msb__check_firmware: Firmware version on sfp module is FRITZ_SFP_FW_rel_1.3.26. Host fw version is FRITZ_SFP_FW_rel_1.3.26.

You could try with a SFP module that has a dedicated chip and operating system, known as GPON Stick, and clone the serial number. The topic recommended by msatter has a list of popular modules.

msatter · Wed May 06, 2020 9:27 pm

Darn it was in front of me and try ssh to IP: 192.168.47.1 as you found with the help of Wireshark. First do a IP Scan to see if it lives as that IP.

tzaman · Thu May 07, 2020 1:59 am

It does. If I move the SFP stick (which is a proper GPON, according to the specsheet I found online) into an unmanaged media converter, I can ping it:

$ ping 192.168.47.1
PING 192.168.47.1 (192.168.47.1): 56 data bytes
64 bytes from 192.168.47.1: icmp_seq=0 ttl=64 time=0.867 ms
64 bytes from 192.168.47.1: icmp_seq=1 ttl=64 time=0.360 ms

Running nmap:

$ nmap -Pn 192.168.47.1
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-06 23:23 CEST
Nmap scan report for 192.168.47.1
Host is up (0.00070s latency).
Not shown: 999 filtered ports
PORT     STATE SERVICE
8888/tcp open  sun-answerbook

Note that the port corresponds to my wireshark dump, it's the same so I know this is the port that Fritz uses to talk to the ONT.

I tried running netcat on the port and actually got a response, but it's not very helpful:

$ echo "printenv" | nc 192.168.47.1 8888
AVMAVM

See how it outputs AVM twice? Regardless of what I send over the socket, it's always that, I guess I just have to brute force it

msatter · Thu May 07, 2020 6:10 pm

I noticed that you already found the IP-Phone-Forum which is the place to go when having a AVM device.

It look like you have to get a GPON that is changeable without having it to be flashed by a programmer. In the Spain thread a lot is talked about those.

tzaman · Thu May 07, 2020 6:24 pm

Yeah, I already reached out to CarlitoxxPro but they are currently in production (and got no ETA), so I figured I'd play with this one. The thing that bugs me is that I believe I'm really really close to nailing this one (sending the serial to Fritzbox's default SFP). Maybe I should bribe an AVM employee

(Also, I've given the "Spain" thread multiple reads, so I guess if I fail at this attempt, one of the above modules should work)

tzaman · Tue May 12, 2020 12:14 pm

Success!

I opened the Fritzbox WAN tcpdump (which I got at fritz.box/html/capture.html) in Wireshark
Located the SYN packet that originated in 192.168.47.2 and went to 192:168.47.1:8888
Followed the TCP stream (A function in Wireshark that extracts/focuses just on one TCP "conversation")
Exported that TCP stream as a pcap file and converted it into raw data with tcptrace
Plugged in the SFP module into my switch, sorted out vlans so I could ping the module
Ran the raw data through netcat:
Code: Select all
```
cat a2b_contents.dat | nc -v 192.168.47.1 8888
```

Boom! SFP module online, internet works perfectly, IPTV does as well.

msatter · Tue May 12, 2020 12:22 pm

Really great that you managed it and you had the right tools to archive this. You made great use of it and please put this also on the IP-Phone-forum so that more can follow you way.

Enjoy your archivement!

tzaman · Tue May 12, 2020 12:53 pm

Thanks! I've already updated the IP-Phone-forum as well - plenty of people helped me out on this one so it's only fair I share the knowledge

msatter · Tue May 12, 2020 2:19 pm

Maybe it would good to put a link to your posting in the ip-phone-forum and back so it will be found easier for others in the future.

tzaman · Tue May 12, 2020 2:30 pm

Sure, here it is.

Cha0s · Tue Nov 29, 2022 11:36 am

Success!
I opened the Fritzbox WAN tcpdump (which I got at fritz.box/html/capture.html) in Wireshark

Located the SYN packet that originated in 192.168.47.2 and went to 192:168.47.1:8888

Followed the TCP stream (A function in Wireshark that extracts/focuses just on one TCP "conversation")

Exported that TCP stream as a pcap file and converted it into raw data with tcptrace

Plugged in the SFP module into my switch, sorted out vlans so I could ping the module
Ran the raw data through netcat:
Code: Select all
cat a2b_contents.dat | nc -v 192.168.47.1 8888
Boom! SFP module online, internet works perfectly, IPTV does as well.

How did you manage to access the SFP module itself?
When I plug in the SFP module in the mikrotik it detects it but the link is down, so any IP I assign onto it (or on any vlan under it) it doesn't work.

ISP SFP GPON in HEX S

ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S

Re: ISP SFP GPON in HEX S