Cable Modem Registration | A Second Look

DOCSIS Cable Modems Registration Process

Even the most interesting man in the world enjoy’s the DOCSIS cable modem registration process, so it is worth a second look.  It is one of the most popular topics because it covers a wide range of how DOCSIS works, from physical layer to Internet protocol (IP) layer.  It is therefore worthy of an encore article with more depth and an update to include DOCSIS 3.0.

During the cable modem registration process it is important to understand that three (3) different levels of communication must take place in order for the registration process to be successful.   The first is the RF physical layer which consists of downstream radio frequency signals from the CMTS to the cable modem and upstream radio frequency signals transmitted from the cable modem to the CMTS.  These RF signals are transmitting digital data that has been modulated on an analog signal.  Second, Media Access Control (MAC) Layer information is contained on the RF signals and is critical communications between the CMTS and cable modem.  Finally, IP data is encapsulated in the MAC Layer data, and so it’s transported by the RF signals between the cable modem and different severs located beyond the CMTS.  In this case the CMTS acts as a relay agent (or router) for the data sent back and forth between the cable modem and IP servers.  These multiple services of communications built on top of each other is commonly referred to as the Open Systems Interconnection Reference Model or OSI Model.  Conceptually the OSI model for DOCSIS looks like this:

It is important to understand that this is a simplified OSI model and some layers are omitted for the purpose of discussion.  What should be apparent from this illustrations is that they physical layer is fundamental to all other layers operating.  Today’s hybrid-fiber coaxial networks (HFC) are bi-directional (meaning RF signals flow in both directions to and from the home).  Signals from the CMTS to the cable modem for DOCSIS 2.0 and 1.x are limited to 88 MHz too 860 MHz while DOCSIS 3.0 cable modems are have an expanded range of 108 MHz to 1002 MHz.  This is called the downstream. The DOCSIS upstream starts at 5 MHz and ends at 42 MHz for North America, while Europe supports 65 MHz and DOCSIS 3.0 supports up to 85 MHz.  A challenge in all of these scenarios is that the downstream and particularly the upstream have numerous impairments causing MAC Layer and IP Layer data impairments (see my articles on Troubleshooting DOCSIS).

First let’s consider the picture below to understand conceptually the DOCSIS network as it exists in a standard cable TV (hybrid fiber-coax or HFC) network.

On the left is a Cable Modem Termination System (CMTS) is connected to an Internet back bone in addition to some level of local or remote back office network of servers.  The back office servers provide provisioning to cable modems, DOCSIS set-top boxes and embedded Multimedia Terminal Adapters (eMTAs).  The most basic elements of the provisioning servers include a Dynamic Host Configuration Protocol (DHCP) server, a Trivial File Transfer Protocol (TFTP) server, and a Time of Day (ToD) server.  The CMTS transmits downstream data via 64- or 256-QAM signals over the RF Plant to the subscriber’s home cable modem.  The cable modem transmits data to the CMTS on the upstream over the RF Plant via QPSK, 8-, 16-, 32-, or 64-QAM modulation.  It is at this point that we must make the assumption that the RF Plant (essentially miles of coaxial cable, fiber optic cable, RF amplifiers, a fiber optic node, Erbium-doped fiber optic amplifiers and countless RF passive devices) is capable of supporting the RF modulations being transmitted by the DOCSIS devices without significant degradation to stop higher layer communications.

DOCSIS Downstream Scanning and Channel Acquisition

Once a cable modem is powered on and connected to the RF cable of a CATV network, it will begin a “hunt” for a valid downstream DOCSIS channel.  First the cable modem looks for and locks to any 64- or 256-QAM digital channel.  Fortunately for the modem, the CMTS is sending out a “Sync” broadcast at least every 200 msec, which is used for system timing.  In addition, the CMTS sends out an Upstream Channel Descriptor (UCD) every two seconds, which tells modems the upstream frequency to transmit on, symbol rate, modulation profile, and other parameters necessary to communicate on the network.  Finally the CMTS is sending out Media Access Protocol (MAP) messages to allocate “talk time” to each cable modem.  You see, since there are many cable modems and only one upstream frequency, the cable modems must “time-share” the upstream channel, which is called Time Division Multiple Access (TDMA).  Now, when the cable modem successfully locks to a QAM channel, it looks for the Sync, UCD and MAP messages from the CMTS.  If it finds these it knows it is on an active DOCSIS channel.  If they are not present, the cable modem assumes the QAM channel is a video channel and continues its search.

DOCSIS Cable Modem Ranging / Station Maintenance

Assuming a successful lock above, the cable modem is now ready to begin ranging with the CMTS.  The ranging process begins with Initial Ranging, which is a process in which the cable modem begins by sending a Range-Request (RNG-REQ) at its lowest transmit power (8 dBmV for DOCSIS 2.0 and 1.x modems and typically 23 dBmV for DOCSIS 3.0 modems).  If it does not receive a Range-Response (RNG-RSP) from the CMTS within 200 msec the cable modem increases its transmit power by 3 dB and retransmits the RNG-REQ.  Repeating this process until a RNG-RSP is received.  See the following diagram:

All initial ranging occurs during a “contention” window, which means that the CMTS does not have prior knowledge of the cable modems existence, but established a window of opportunity for new cable modems to range called the initial ranging window.  Therefore it is possible that when multiple cable modems are attempting to register during the contention window that they could interfere with each other and cause collisions.  DOCSIS has a built-in back-off window for just such an occurrence which will help alleviate collisions in the contention window.  This is most prevalent when there is a system outage and many cable modems are trying to come back online at the same time.  Once the modem has received its first RNG-RSP from the CMTS it will moved from Initial Ranging to Station Maintenance.  The cable modem will also be instructed by the CMTS to make adjustments to its transmitting frequency, amplitude, timing offset and optionally pre-equalization.  Station Maintenance (Ranging) will occur at least once every 30 seconds (typically every 20 seconds) for each cable modem on the DOCSIS network to continue making these adjustments and so that the CMTS knows the modems are online.  It is during the station maintenance window when T3 and T4 timeouts are logged.

A Brief Aside on T3 and T4 Timeouts

T3 and T4 timeouts occur during station maintenance and do provide insight to the health of a DOCSIS plant as well as diagnostics.  The counters themselves are in the DOCSIS cable modems and start and stop at the beginning and end of the station maintenance process.  The CMTS sends a MAP message to the cable modem instructing it to send a RNG-REQ to the CMTS, so the CMTS knows the message is coming.  Once the cable modem transmits the RNG-REQ it starts an internal counter.  If the cable modem does not receive a RNG-RSP in 200 msec it flags a T3 timeout.  One can assume if the CMTS did not send the RNG-RSP it most likely did not receive the RNG-REQ due to upstream impairments, therefore T3 timeouts usually indicate upstream impairment.

When the CMTS does not receive the RNG-RSP it will send a new MAP for another RNG-REQ.  If again the RNG-RSP is not received another T3 timeout will be generated.  Once a certain number of T3 timeouts or time is exceeded (typically about 15 T3 timeouts, but this is vendor-based), the cable modem will be forced to re-register and a T4 timeout error will be logged.  A T4 timeout can indicate an upstream that is not passing traffic or even possible downstream problems.  But most often a T4 timeout occurs when the MAP message for a RNG-REQ is lost in the downstream, which indicates potential downstream issues.

DOCSIS Cable Modem DHCP

Next the cable modem is ready to move from DOCSIS protocol communications to IP layer communication and perform DHCP to get an IP address and the addresses of other devices in the network.  Now that the cable modem is operating within its TDMA parameters, it must first ask for permission to transmit data to the CMTS by sending a bandwidth REQUEST (REQ).  The CMTS will prioritize the request in its queue and issue a MAP for the specific cable modem.  When the cable modem’s time slot comes up, it can transmit a DHCP discover to find a DHCP server.  The DHCP server on the network will respond and offer an IP address to the cable modem along with a number of other network addresses, gateways and parameters for proper network operation.  A DHCP Request and Acknowledgement are required to complete and confirm the transactions.  DOCSIS 3.0 devices have the option of obtaining IPv4 or IPv6 IP addresses.

DHCP and ToD

Next the cable modem will request the Time of Day from the ToD server.  This is not to be confused with the DOCSIS Timing Interface (DTI) server that is part of DOCSIS 3.0 dramatically improves overall timing accuracy.

DOCSIS Cable Modem Configuration File

Now the cable modem is ready to download a very important file called a configuration file from the TFTP server.  The configuration file contains all of the parameters the cable modems needs for network access speeds, quality of service, advanced service features such as voice-over-IP and much more.  The following diagram illustrates the flow of procuring the configuration file.

Upon validating the MD5 check-sum to ensure the TFTP file was properly downloaded, the cable modem is now ready to perform the most important step – registration.  The cable will send a Registration Request to the CMTS along with a list of TLV (Type Length Value) parameters that tell the CMTS how the cable modem has been told it is to operate on the network.  The CMTS reviews this information against the parameters it has been programmed with by the system administrator.  Provided the cable modem has not be “hacked”, data has been corrupted or there is an interoperability issue, the CMTS will send a Registration Response “Okay” message and assign the cable modem a Service IDentifier (SID).  The cable modem will respond back with a Registration Acknowledgment notifying the CMTS that it has received confirmation of registration and it is now online and ready for subscribers to transmit Internet data.

DOCSIS 3.0 Cable Modem Additions

The registration process with a DOCSIS 3.0 cable modem is significantly more complicated than with DOCSIS 1.x or 2.0 cable modems.  There are some similarities in that the cable modem must provide its Time, Length, Value (TLV), class of service and other parameters to the CMTS via a REGistration REQuest (REG-REQ) message.  The CMTS validates this information and determines if the cable modem is permitted to be on the DOCSIS network.  In the case of a DOCSIS 3.0 cable modem, if there are other downstream and/or upstream channels that need to be bonded, this is the time that the bonding must occur.

The CMTS checks its Receive Channel Profile (RCP) against the what the cable modem has been told to bond channels in the downstream.  If these match up, the CMTS enables Multiple Receive Channel Mode in the cable modem and the cable modem will start downstream bonding.  The cable modem must also tell the CMTS that it is able to receive all of the downstreams against a Receive Channel Configuration (RCC) message sent by the CMTS.  If anything fails during this process it is likely that the cable modem will end up reverting to a DOCSIS 2.0 state because downstream channel bonding is usually an all-or-nothing proposition.  CMTSs are typically not configured to allow for partial downstream bonding, though this can be done with substantial effort.

If the cable modem supports multiple upstream channel transmit and the CMTS is configured for it, the CMTS will enable Multiple Transmit Channel Mode and provide a Transmit Channel Configuration (TCC) message telling the cable modem the center frequency of each upstream channel.  Next the cable modem will range with each upstream channel on the TCC.  What differs with upstream bonding is if the cable modem us not able to range and register with a particular upstream channel, the cable modem will notify the CMTS but will be permitted to stay online in DOCSIS 3.0 mode and register with as many upstreams as possible.  This is called partial service and was discussed in a previous article.

After registration a cable modem could next enter an encryption mode called Baseline Privacy Interface (BPI) protocol.

Link back to original DOCSIS Tutorial Series

Upcoming events can be seen under Broadband Events. Previous events can be seen under the blog.

• If you are watching this on youtube please hit the subscribe button!
• Let us know what you think and remember to share!  
• You can find slides at the bottom of the page and some on slideshare.  
• Find out about events or articles by following us on Twitter, LinkedIn or Facebook too.

Also available on iTunes, Google Podcasts, Spotify, vurbl see podcasts “get your tech on”.