Community discussions

MikroTik App
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

ISP SFP GPON in HEX S

Sat May 02, 2020 3:46 pm

So, my ISP has provided me with a Fritzbox 5491, which I absolutely hate, so I've set myself on a mission to get rid of it.

The only good part about it is that it comes with a proper SFP GPON module (Cigtech G-95SP), which can be pulled out of the device and inserted into my Mikrotik hex S.

But it does not work, and I know why, just not sure how to solve it.

The thing is that the module has no serial number on itself, so the OLT doesn't let it online. The way that Fritzbox does it, it makes a TCP request to the module's IP address (which I've discovered with Wireshark, and in my case, it's 192.168.47.1) and in the payload, the serial number is transmitted over to the GPON, which then is allowed online by the OLT.

I can confirm my ISP uses Serial Number authentication because I also tried flashing Unifi Nano G with the serial from Fritzbox and it gets online (but has other issues).

So of course the next step for me was to try and navigate (in browser) to the IP of the SFP module, but it refuses the connection outright.

And now I'm here, looking for suggestions and the question whether anyone has attempted the same thing and if they had any luck?

Thanks!
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Mon May 04, 2020 6:26 pm

If you search for the word "spain" here you will find a lot postings about gpon andaccess.
 
User avatar
JeanPierre
Frequent Visitor
Frequent Visitor
Posts: 59
Joined: Tue Oct 01, 2019 7:04 pm

Re: ISP SFP GPON in HEX S

Mon May 04, 2020 8:14 pm

See what you get when you put the module in the Mikrotik router. Wait up to 2 minutes for results.
[admin@MikroTik] > interface ethernet monitor sfp1
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Wed May 06, 2020 11:15 am

See what you get when you put the module in the Mikrotik router. Wait up to 2 minutes for results.
[admin@MikroTik] > interface ethernet monitor sfp1
Already did that, the problem is that sfp-vendor-serial field is empty. I actually got a dump from Fritzbox's dmesg, and I can see there's a process in it that updates GPON serial at device boot. The only problem is I can't see the source code of that process.

Here's the relevant log part:
[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_get_cmd_pipe_from_daemon: Daemon is not running
[AVM2FIBER MAIN][INFO]Start deamon now
[AVM2FIBER MAIN][INFO]Start as daemon
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_pollEvent: connection with SFP established.
[AVM2FIBER MAIN][WARN]avm2fiber_xdsld_check_sfpconnection: Failed to connect with outbound socket.
[AVM2FIBER MAIN][WARN]avm2fiber_xdsld_check_sfpconnection: Failed to connect with inbound socket.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_check_sfpconnection: connection with outbound socket succeeded.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_check_sfpconnection: connection with inbound socket succeeded.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: initializing SFP
[AVM2FIBER MAIN][INFO]avm2fiber_msb__check_firmware: Firmware version on sfp module is FRITZ_SFP_FW_rel_1.3.26. Host fw version is FRITZ_SFP_FW_rel_1.3.26.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: firmware version on sfp module ok!   
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_sendIfaceStatusNotify: trigger IFACE_STATUS_NOTIFY status=0
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_initialize_sfp: SFP initilized succesfully.
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Version Number (String)=
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Vendor Serial Number (String)= 444E6DXXXXXX F!Box5491 171.07.12
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_print_cpe_inventory CPE Vendor ID (String)= <0x04>
[AVM2FIBER MAIN][INFO]setting equid F!Box5491
[AVM2FIBER MAIN][INFO]setting version 07.12_1.3.26
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: zero password length. Clearing password!
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: setting serial and pw!
[AVM2FIBER MAIN][INFO]avm2fiber_msb__set_gsn: setting gpon serial to AVMG62XXXXXX successful
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_handleGponConfigSetEvent: Now sending!
[AVM2FIBER MAIN][INFO]< AVMEVENT: 5 | mode: FIBER | US rate: 0 | DS rate: 0 | Reason flags: 0x00000000 >
[AVM2FIBER MAIN][INFO]< AVMEVENT: 6 | mode: FIBER | US rate: 1000000 | DS rate: 1000000 | Reason flags: 0x00000000 >
[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]started..
[AVM2FIBER MAIN][INFO]avm2fiber_xdsld_client_mode_send_cmd_to_daemon: print supportdata to stdout    
[AVM2FIBER MAIN][INFO]main: program terminate not running as a daemon (clientMode)
[AVM2FIBER MAIN][INFO]started..
I was hoping Mikrotik maybe has some utility to "talk to SFP" modules.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Wed May 06, 2020 1:46 pm

Spain: viewtopic.php?f=3&t=116364&p=789506&hilit=spain#p762916

It is not the solution but a start for you.
 
User avatar
JeanPierre
Frequent Visitor
Frequent Visitor
Posts: 59
Joined: Tue Oct 01, 2019 7:04 pm

Re: ISP SFP GPON in HEX S

Wed May 06, 2020 8:05 pm

Not much information on the SFP module manufacturer's website.
https://www.cigtech.com/product_portfol ... spg-97s-2/

This module is probably a GPON ONU that relies on the Frizbox's host CPU to perform heavy lifting.
[AVM2FIBER MAIN][INFO]avm2fiber_msb__check_firmware: Firmware version on sfp module is FRITZ_SFP_FW_rel_1.3.26. Host fw version is FRITZ_SFP_FW_rel_1.3.26.

You could try with a SFP module that has a dedicated chip and operating system, known as GPON Stick, and clone the serial number. The topic recommended by msatter has a list of popular modules.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Wed May 06, 2020 9:27 pm

Darn it was in front of me and try ssh to IP: 192.168.47.1 as you found with the help of Wireshark. First do a IP Scan to see if it lives as that IP.
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Thu May 07, 2020 1:59 am

It does. If I move the SFP stick (which is a proper GPON, according to the specsheet I found online) into an unmanaged media converter, I can ping it:
$ ping 192.168.47.1
PING 192.168.47.1 (192.168.47.1): 56 data bytes
64 bytes from 192.168.47.1: icmp_seq=0 ttl=64 time=0.867 ms
64 bytes from 192.168.47.1: icmp_seq=1 ttl=64 time=0.360 ms

Running nmap:
$ nmap -Pn 192.168.47.1
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-06 23:23 CEST
Nmap scan report for 192.168.47.1
Host is up (0.00070s latency).
Not shown: 999 filtered ports
PORT     STATE SERVICE
8888/tcp open  sun-answerbook
Note that the port corresponds to my wireshark dump, it's the same so I know this is the port that Fritz uses to talk to the ONT.

I tried running netcat on the port and actually got a response, but it's not very helpful:
$ echo "printenv" | nc 192.168.47.1 8888
AVMAVM
See how it outputs AVM twice? Regardless of what I send over the socket, it's always that, I guess I just have to brute force it :)
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Thu May 07, 2020 6:10 pm

I noticed that you already found the IP-Phone-Forum which is the place to go when having a AVM device.

It look like you have to get a GPON that is changeable without having it to be flashed by a programmer. In the Spain thread a lot is talked about those.
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Thu May 07, 2020 6:24 pm

Yeah, I already reached out to CarlitoxxPro but they are currently in production (and got no ETA), so I figured I'd play with this one. The thing that bugs me is that I believe I'm really really close to nailing this one (sending the serial to Fritzbox's default SFP). Maybe I should bribe an AVM employee :D

(Also, I've given the "Spain" thread multiple reads, so I guess if I fail at this attempt, one of the above modules should work)
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Tue May 12, 2020 12:14 pm

Success!

  • I opened the Fritzbox WAN tcpdump (which I got at fritz.box/html/capture.html) in Wireshark
  • Located the SYN packet that originated in 192.168.47.2 and went to 192:168.47.1:8888
  • Followed the TCP stream (A function in Wireshark that extracts/focuses just on one TCP "conversation")
  • Exported that TCP stream as a pcap file and converted it into raw data with tcptrace
  • Plugged in the SFP module into my switch, sorted out vlans so I could ping the module
  • Ran the raw data through netcat:
    cat a2b_contents.dat | nc -v 192.168.47.1 8888
Boom! SFP module online, internet works perfectly, IPTV does as well.

Image
Last edited by tzaman on Tue May 12, 2020 1:19 pm, edited 1 time in total.
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Tue May 12, 2020 12:22 pm

Really great that you managed it and you had the right tools to archive this. You made great use of it and please put this also on the IP-Phone-forum so that more can follow you way.

Enjoy your archivement! :D
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Tue May 12, 2020 12:53 pm

Thanks! I've already updated the IP-Phone-forum as well - plenty of people helped me out on this one so it's only fair I share the knowledge :)
 
msatter
Forum Guru
Forum Guru
Posts: 2897
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: ISP SFP GPON in HEX S

Tue May 12, 2020 2:19 pm

Maybe it would good to put a link to your posting in the ip-phone-forum and back so it will be found easier for others in the future.
 
User avatar
tzaman
just joined
Topic Author
Posts: 8
Joined: Sat May 02, 2020 3:34 pm

Re: ISP SFP GPON in HEX S

Tue May 12, 2020 2:30 pm

 
User avatar
Cha0s
Forum Guru
Forum Guru
Posts: 1135
Joined: Tue Oct 11, 2005 4:53 pm

Re: ISP SFP GPON in HEX S

Tue Nov 29, 2022 11:36 am

Success!

  • I opened the Fritzbox WAN tcpdump (which I got at fritz.box/html/capture.html) in Wireshark
  • Located the SYN packet that originated in 192.168.47.2 and went to 192:168.47.1:8888
  • Followed the TCP stream (A function in Wireshark that extracts/focuses just on one TCP "conversation")
  • Exported that TCP stream as a pcap file and converted it into raw data with tcptrace
  • Plugged in the SFP module into my switch, sorted out vlans so I could ping the module
  • Ran the raw data through netcat:
    cat a2b_contents.dat | nc -v 192.168.47.1 8888
Boom! SFP module online, internet works perfectly, IPTV does as well.
How did you manage to access the SFP module itself?
When I plug in the SFP module in the mikrotik it detects it but the link is down, so any IP I assign onto it (or on any vlan under it) it doesn't work.

Who is online

Users browsing this forum: karlisi and 98 guests