Sunday, September 12, 2010

How to uncap Docsis compliant Cable Modems for unbelivable speeds

The information given below is for educational purpose only. If you’re thinking about uncapping your cable modem, be warned. Your service agreement prohibits uncapping or removing software blocks that limit or “cap” bandwidth. Uncap your cable modem and you will at the very least be banned from your ISP for life. The bottom line is that uncapping is questionable at best and illegal at worst.

There are usually two network configurations. (1) The PC is directly connected to the cable modem. (2) The PC is connected to a NAT router, whose WAN port is then in turn connected to the cable modem. All of the following steps apply to both cases, except the final one that deals with TFTP. I’ll explain the issues with this later.
Every time the cable modem is powered on, it looks in its configuration file for the address of an TFTP server and for a file name. This file is the Docsis configuration file that, among other things, sets a cap for the modem’s download/upload bandwidth. The cable modem then retrieves that file and connects to the backbone.
How do we uncap it? Simple. We’ll download the docsis config file, edit it to change the cap parameters, then trick the cable modem in thinking our PC is the TFTP server so it then retrieves our copy of the docsis file.
There’s a bit of work involved for this. First, we have to find out the TFTP server and file name used by the cable modem. For this we can use the docsisDiag utility ( This application, along with all others, is included in the file. Run docsdiag.bat. It uses SNMP to return many of the modem’s parameters. Among these, the one we need are:
Configuration TFTP Server          = (replace this with yours throughout in the doc)
Configuration filename    = isrr.bin (replace this with yours throughout in the doc)
IP fragments created            = 0
IP    =

IP address. =   (the IP address of the cable modem, (replace this with yours throughout in the doc)     = 2
This application works as is in many cases. If not, please refer to the DocsDiag - DOCSIS cable modem diagnostics.htm file in the same directory. It has a lot of help on how to make it work for different modems.
Note that you might now go to and see some of you modem’s parameters.
Now from a DOS prompt type:
tftp -i GET isrr.bin

You just downloaded the docsis configuration file from your ISP. Now it’s time to edit it to change the modem’s cap. This is done by using the Cisco Docsis configuration software in the docsisConfig directory (also available from Before running ConfigEdit.bat you’ll need to edit it and follow the instructions contained there. Then execute ConfigEdit.bat and open the .bin file you TFTP'd. Go to the "Class of Service" tab. Voila'. Change the Max DS Rate to 7MB (mine doesn't seem to go higher). Save.
We will now need to have the cable modem think we are the ISP and retrieve our version of the file by running our own TFTP server.


This is the point where our network configuration is important. Here are the two cases. Both assume we’re running Windows 2000.

1.     PC Directly Connected to Cable Modem

Configure your PC’s TCP settings for:
IP:  (replace with the ISP’s tftp server)
Gateway:  (replace with your cable modem’s IP address)

don't worry about the DNS...
When it's done change your TCP settings to use DHCP again, without. Check or with the docsDiag utility. Your speed limit should now be updated.

2.      PC à NAT Router  à Cable Modem

Set your Router not to use DHCP but to use:
IP:  (replace with the ISP’s tftp server)
Gateway:  (replace with your cable modem’s IP address)
You’ll now have to configure the Router to send all traffic to your PC. LinkSys does this by configuring your PC for the DMZ setting. Other routers may be different. All that should be needed is to either forward all external traffic to your PC or to make your PC visible to the other side of the firewall.
Configure your PC with a static IP address in a range used by your router. Ex. If your router is at then configure your PC for:
Now add an additional IP address to the TCP settings in your PC:
IP:  (replace with the ISP’s tftp server)
don't worry about the DNS...
This is done because you’ll have to tell you TFTP server to listen on the latter address.
You shouldn't have to reboot. Place your modified copy of the isrr.bin (replace this with your name) in the tftpd directory (also available at If in your case the docsdiag showed it inside a subdirectrory you'll have to create one here. Start tftpd32 server. Go to Settings and set the Security to None. Increase the timeout to 20secs and the Max Retransmit to 6. Choose to translate Unix filenames. Make sure it's base directory point to where the isrr.bin is. Ok it. If you fall in case (2) make sure you set IP address in the Server Interfaces.
We now have to start filling the routing tables in the devices with our bogus data. So start pinging your cable modem, the TFTP IP address, and if applicable, your router. Do this for a couple of minutes. Now power off the cable modem (I usually wait a few seconds just to be sure) and then power it back on. Then immediately start pinging your cable modem until the config file has been transferred. After the traffic lights blinks the first time you should see that your tftp server is sending it your file...!
Now reconfigure your Router for DHCP (if case 2), and then reconfigure your PC to DHCP.
You’re done!
You’ll have to repeat this procedure every time the modem is powered off.

No comments:

Post a Comment