DOCSIS Station Maintenance

While the UCD provides the language of the DOCSIS network, the DOCSIS Station Maintenance messaging is the proverbial “heartbeat” of the DOCSIS network.  A station maintenance session consists of a Range Request sent from a cable and a Range Response sent by the CMTS.  The CMTS analyzes the signal quality of the Range Request message and sends back any necessary RF adjustments in the Range Response message.  This “handshake” between every cable modem and the CMTS must occur once every 30 seconds as dictated by the DOCSIS specification.

The following is an example of what a Range Request message looks like coming from a cable modem Source MAC Address (PDU SA) of 00204066A0AE to the CMTS Destination MAC Address (PDU DA) of 00070DAEC8A8:

Note: If you Google “OUI” and then the first six digits of any MAC address you will get a “MAC Address Lookup” hit that will tell you the vendor name of the equipment that you are using.  For example, Google “OUI 002040” and find out what cable modem manufacturer sent this Range Request message.

Range Request (RNG-REQ)

Upstream MAC type = RNG-REQ
MAC FC (HEX) = C0
MAC PARM (HEX) = 00
MAC LEN (HEX) = 001C
MAC HCS (HEX) = EA1D
PDU bytes = 28
PDU DA (HEX) = 00070DAEC8A8
PDU SA (HEX) = 00204066A0AE

PDU Type/Len (HEX)= 000A
MMH Version (HEX)= 01
MMH Type (HEX)= 04

MMH RSVD (HEX)= 00

MMM Type: RNG-REQ
SID (HEX): 0201
Downstream Channel ID (HEX): 03

Pending Till Complete: 0

After examining the Range Request (from here on out I will use RNG-REQ per the DOCSIS specification) you will find that it contains very little information.  Clearly it must contain the type of message, which is a RNG-REQ.  The source and destination MAC address so that the CMTS knows how to route the message and from which cable modem the message came .  The RNG-REQ must also contain its permanent SID (temporary SID if it is just coming online) and the Downstream Channel ID (i.e. the name of downstream DOCSIS channel it is receiving data).  As seen in the message, the RNG-REQ is only 28 bytes long, so this a very short message, which is important since it is sent by every cable modem at least once every 30 seconds (CMTS vendors normally reduce this time to 20 seconds or less to eliminate T4 timeouts – more on this shortly).  The Pending Till Complete field is also required, since it has a value of zero (0) in this example it indicates that all previous RNG-REQ changes have been completed before this RNG-REQ was transmitted.  If there is a non-zero value, then this is time estimated to complete changing new parameters from the previous Range Response.  Note that only equalization can be deferred.  Units are in unsigned centiseconds (10 msec).  The referenced changes will now be discussed in the following section on Range Response.

Range Response (RNG-RSP)

Once the CMTS receives a RNG-REQ  from a cable modem it must send a Range Response (from here on out I will use RNG-RSP) within 200 msec per the DOCSIS specification.  If the cable modem does not receive the RNG-RSP within this interval a T3 timeout error will be generated.  CMTS vendors configure their equipment to send RNG-RSP messages much faster than 200 msec to avoid CMTS-related T3 timeout errors.  Before the CMTS sends the RNG-RSP it must first analyze the signal integrity of the RNG-REQ to determine if the receive level at the CMTS is correct, the cable modem transmit frequency is on center, the burst arrived at exactly the time interval the CMTS was expecting it, and if equalization is being used any parameters need to be adjusted (equalization is not enabled in the example below).  Once this analysis is complete, the CMTS sends a RNG-RSP message back to the cable modem with any necessary corrections.  This provides for a certain amount of “self-healing” in a DOCSIS network to make up of what are called “diurnal” or daily changes in the HFC network which change RF attenuation and gain.  Additionally, subscribers may move a cable modem, eMTA, or DOCSIS enabled settop box to a new location in their home having added attenuation.  Further, customer premise equipment (CPE) may age causing component drift in upstream transmitters than can be corrected to some extent by the CMTS via the RNG-RSP message.  All of this will help maintain a DOCSIS network, but cable modems do have maximum limits and once they are reached troubleshooting must begin.

Let’s now analyze the content of the RNG-RSP to see the changes it may communicate to a cable modem:

Downstream MAC type = RNG-RSP
MAC FC (HEX) = C2
MAC PARM/EHDR length (HEX) = 00
MAC LEN (HEX) = 002B
MAC HCS (HEX) = A061
PDU bytes = 43
PDU DA (HEX) = 00204066A0AE
PDU SA (HEX) = 00070DAEC8A8

PDU Type/Len (HEX)= 0019
MMH Version (HEX)= 01

MMH Type (HEX)= 05

MMM Type: RNG-RSP
SID (HEX): 0201

Upstream Channel ID (HEX): 01

RNG-RSP TLV Type: 1

Timing Adjust: 0

RNG-RSP TLV Type: 2

Power Level Adjust: -7

RNG-RSP TLV Type: 3

Offset Frequency Adjust (Hz): 0

RNG-RSP TLV Type: 5

Ranging Status: 3

In the example above, you will first notice that the PDU DA and PDU SA MAC addresses have switched positions from the RNG-REQ example.  So we are still dealing with same two pieces of equipment (same cable modem and same CMTS – did you Google the OUI yet?).

The Timing Adjust is the amount that the cable must change its transmit time in order for its bursts to arrive at the CMTS when the CMTS expects the bursts to arrive.  The units are (1 / 10.24 MHz) = 97.65625 ns.  A negative value means that the Ranging Offset will be decreased and the cable modem’s bursts will arrive later.  Timing is quite critical in a TDMA-based system because if the bursts from one cable modem come too early or too late they could potentially collide with another modem, in which case both transmission will be corrupted and all data is lost.  In this example the timing adjustment is zero (0), so the cable modem is dead on from a timing perspective.

Power Level adjustment is the next TLV (Time Length Value) parameter.  This is a relative integer value that tells the cable modem to increase its transmit power when positive and decrease its transmit power when negative.  The units are in 0.25 dB increments, so in the example above the adjustment is -7 * 0.25 dB = -1.75 dB.  This indicates the cable modem is currently transmitting almost 2 dB too high and needs to reduce its transmit power accordingly.

The center frequency of the upstream transmitter in the cable modem is adjusted by the Offset Frequency Adjust parameter.  Its units are in Hertz and in the example above no adjustment is necessary.

The Ranging Status parameter is used to tell the cable modem the status of the next station maintenance message.  The available options are  1 = continue, 2 = abort, 3 = success.  In the example a “3” or “success” was transmitted, so normally ranging will continue.  If a “1” was transmitted this would indicated that major adjustments need to be made and rapid station maintenance messages would occur.  An abort would tell the cable modem to re-transmit a RNG-REQ and no adjustments were being made in this RNG-RSP.

There are additional functions that can occur during station maintenance which are not included in this example which include:

  • CM Transmitter Equalization Information:  This message will change the pre-equalization in a cable modem to improve upstream transmission in an impaired HFC plant.
  • Downstream Frequency Override:  This cause the modem to switch to a new downstream frequency and re-register with the DOCSIS network.
  • Upstream Channel ID Override:  This will cause the cable modem to change upstream channels and range with the new upstream.

T3 and T4 Timeouts

I wanted to close this topic with a discussion on T3 and T4 timeouts as I have received many questions on “what causes T3 and T4 timeouts?”  Fundamentally, a T3 timeout occurs when the cable modem fails to receive a RNG-RSP from the CMTS within 200 msec (after sending a RNG-REQ).  A T4 timeout occurs when a cable modem fails to receive a RNG-REQ transmit grant MAP from the CMTS within 35 sec on the downstream channel (after receiving the previous RNG-RSP).  There are number of reasons that these could occur and I will list a couple below for each and help guide you the root cause, but understand this is not and exhaustive list.

T3 Timeout No RNG-RSP in 200 msec – Typically an Upstream Problem

  • Most likely cause is upstream impairments preventing the RNG-REQ from reaching the CMTS, therefore the CMTS never transmits a RNG-RSP
  • May occur because the RNG-REQs from multiple cable modems collided, again the CMTS does not receive the RNG-REQ (now from multiple modems) and fails to process multiple RNG-RSP messages resulting in multiple T3 timeouts
  • CMTS over-utilization – unable to process RNG-REQ and/or RNG-RSP within T3 time frame (200 msec)
    • T4 timeouts can usually be identified with downstream impairments causing the cable modem to miss receiving the RNG-REQ grant MAP transmitted to it
    • If T4 errors are impacting many modems off of a common leg, trouble shoot that leg
    • If T4 errors are just associated with one modem, look for low MER/level at that modem
    • T4 timeouts can also be associated with a CMTS that has extremely high utilization i.e. >95% depending on the vendor and firmware version
    • Rule of thumb for CMTS utilization is 80% to allow for peak usage periods
  • It is highly unlikely that T4 timeouts are associated with any upstream impairmentsCan also be a downstream problem due to plant impairments – i.e. RNG-RSP is transmitted, but corrupted in route and the cable modem never receives the message
  • Look for low MER at the cable modem

T4 Timeout No RNG-REQ Grant MAP Received by Cable Modem in 35 sec – Typically a Downstream Problem

Upcoming events can be seen under Broadband Events. Previous events can be seen under the blog.

  • If you are watching this on youtube please hit the subscribe button!
  • Let us know what you think and remember to share!  
  • You can find slides at the bottom of the page and some on slideshare.  
  • Find out about events or articles by following us on TwitterLinkedIn or Facebook too.

Also available on iTunes, Google Podcasts, Spotifyvurbl see podcasts “get your tech on”.

Spotify  Vurbl