Talking To My Cable Modem

I recently purchased and began using a cable modem – the Zyxel (Hitron)

It (so far) Just Works (I plugged into my router running OpenWRT, the router gets an IP address (via DHCP), and we have net connectivity), but I’d like to hack into the device, to play with it, find any tunables and settings, and just understand it better.

The public interface of the router gets an IP address from my ISP’s address space, and that’s the IP address that outbound connections are initiated from. Tracerouting out shows the first hop as a private IP
address on my LAN (, and the next hop is an address in my ISP’s space (specifically, the address the router is getting assigned but with the last quad replaced with ’1′).

The thing comes with no manual or disk, just a quickstart guide, containing nothing beyond very basic quickstart instructions. I have no idea if this thing even has a web interface – I can’t find one on any of the addresses I’ve tried. I’ve tried portscanning with nmap, pointing it at the address of the first hop, and I get no open ports, and the only closed one is 179/bgp; I’m guessing this is my ISP’s edge router.

Am I correct in assuming that my modem has no IP address, and is operating in bridge mode? Any idea how I can access it? The thing’s datasheet claims that it has “extensive SNMP management support”, but I
have never used snmp and I have no idea what to do with it.


, , ,

  1. #1 by Karl E. on January 23rd, 2013 - 8:46 am

    That IP address (x.x.x.1) is probably your ISP router – .1 is commonly used for routers.

    Hm… surely the thing must have an internal IP address. Perhaps the OpenWRT can tell you? If it got its IP address via DHCP, it should have it’s default gateway set to the IP address of the cable modem.

    Try running nmap(1) against it – on the internal IP address of it.

    Perhaps it supports UPNP ? If so, you may be able to use the upnp-router-control package/app to extract some interesting information from it..

  2. #2 by Celejar on January 23rd, 2013 - 5:05 pm

    I figured as much, as per my original email (below).

    The gateway is that (presumed) edge router on the ISP’s network.

    There is no IP address at all, AFAICT. The OpenWRT box seems to be getting an IP address on its external interface from somewhere on the ISP’s network, and I have no idea what IP address, if any, the modem itself has.

    Tried it, but I’m not sure what I’m supposed to be doing. Running it on my linux laptop returns no available information .



  3. #3 by Kelly Clowers on January 23rd, 2013 - 5:22 pm

    Huh, I dunno. I am used to Moto Surfboards, they all seem to use

    Actually, I think that might be semi-standard, at least try it. If it has snmp, you could look for that with, say, nmap (assuming it is enabled)

    Cheers, Kelly Clowers

  4. #4 by Celejar on January 23rd, 2013 - 5:52 pm

    Huh, look at that – it has a web interface at that address. How on earth I was supposed to figure that out is beyond me, but thanks a million! [I'm used to routers, which in my experience generally use or]

    It seems to show a lot of information, but I see almost nothing in the way of settings. I suppose that if it really has no router functionality, and just acts as a simple bridge, there isn’t much to tune?

    Thanks again.


  5. #5 by Kelly Clowers on January 23rd, 2013 - 7:54 pm

    Yeah, it seems they don’t want people to know. Glad it worked, though!
    Pretty sure one reason they use .100.1 is to avoid stepping on the toes of home routers, since they are often used together.

    As far as settings, I think you have to hack it a bit to do that, if it is possible at all. It is on some Motos, I know…

    Cheers, Kelly Clowers

  6. #6 by Celejar on January 23rd, 2013 - 8:47 pm

    Makes sense.

    I guess that part of the problem is that unlike routers, which have basic networking settings that are generally standard and well understood, the cable modem stuff seems to include a lot of highly specialized and arcane settings that aren’t meant for the layman.

    Thanks, Celejar

(will not be published)
Subscribe to comments feed