/TG3442DE-Teardown

Teardowning a Vodafone TG3442DE Cable router

TG3442DE Teardown

A fun project disassembling and understanding a Vodafone TG3442DE cable router (aka Arris Touchstone TG3442: commscope.com product page).

Goals

  1. Using the cable-interface for wiretapping and analyzing the DOCSIS 3.1 Protocol
  2. Understanding why Vodafone does not support IPv6-addresses while the router is in bridge mode (to be proven: IPv6 is used for VoIP-Telephony and is therefore terminated at the TG3442 running in bridged mode)

Hardware

For Hardware-Identification see: Hardware.md

Information: Description:
Branding: Vodafone
Model No.: TG3442DE
Hardware Version: MP1
CPU: Intel FHCE2752M (Intel Puma 7 SoC CE2752M) 2 cores, 2.5 GHz, Intel Atom Arch (Intel Puma 7 product family page)
RAM: Samsung K4B2G1646F-BYK0 ???Capacity used (4x512 MByte?)??? 4x DDR3-RAM (Samsung product page) [FIXME: exact capacity]
Flash: Kioxia TC58NVG2S0HBAI4 512 MByte SLC NAND EEPROM (Toshiba/Kioxia product page)
Subscriber Line IC (SLIC): Microsemi ZL88107 Microsemi Corporation, ???maybe part of ZL880 series -> product page??? [FIXME: exact ref missing]
eMMC: Phison PS8211-0
2.4GHz RF: Celeno CL2432 3x3 802.11ac 2.4GHz RF chip (celeno.com product page)
5GHz RF: Celeno CL2440 4x4 802.11ac Wave 2 5GHz RF chip (celeno.com product page)
cable gateway SoC: MaxLinear MXL277 cable gateway, front-end SoC designed for DOCSIS 3.1 (maxlinear.com product page)
cable upstream amplifier: MaxLinear MXL236 PGA IC designed for DOCSIS 3.1 (maxlinear.com product page)

Firmware/Software

For documentation on the software see: Software.md

Related and interesting stuff