Unlocked Firmware For Bt Business Hub 2700hgv **Upgrade at your own risk**

Does it do a check on the firmware to make sure its not corrupt or been modified?

Even if it does, depending on how it works has anyone tried simply hex editing the firmware file to change some of those values you mentioned? Perhaps you can hack it to default to the right VoIP settings?

Originally Posted by Alex Atkin

I tried a simple change but there is clearly a checksum somewhere, as would be expected with something like firmware

I just got one of these routers off eBay after reading about it being good for longish lines. On a speedtouch 330 modem I have connected up to 5500ish more or less stable during the day but during the evening it resync nearer 4500. Lately its getting lower and lower so hopefully this router will give the exchange a good kick up the backside because for ages it was stable at 4567 which was perfect for the 4000 BRAS profile.

Originally Posted by Alex Atkin

Report back your findings! I'd be interested how it compares.

One other thing and I know it might sound stupid but I had to ask. Can we be sure that the remote management is blocked off in the unlocked firmware? Just wouldnt be funny if the US company its from randomly hit one of our routers and changed the settings accidentally. I havent seen much explanation on how that sort of stuff works in this router. Perhaps I will understand it all more once I see how the router actually works in person.

Originally Posted by Alex Atkin

You can see all of the provisioning info under http://router_ip/tech then click 'Provisioning Info' on the LHS. The SBC firmware sets most of this stuff to point to http://gateway.cms.2wire.com/ which I presume is the router itself (I use a local DNS server , so these domain names are a bit of a pain sometimes!) By comparison the BT firmware points a lot of the provisioning URLs at their own servers.

[Alex Atkin]

Thanks for that.

I have recently had the master socket resited further away from my HDTV and other electronic equipment which seemed to improve my sync a bit. Also the wire had oxidised at the terminals so about a foot of wire was chopped off leaving nice clean copper on the terminals now.

The only real ass is while its copper to the house its aluminium from the bottom of the street to the exchange which cant help. My friend round the corner however has been getting 100K/sec faster than me as he just got ADSL2 (im still ADSL1) and his router reports 2dB more attenuation than mine did but a better SNR. Of course I take that with a pinch of salt as being two totally different routers with a different ADSL version its impossible to know if my stats would be the same as they are now.

I will be sure to let everyone know how the line goes over a week or so after I get the router. Hopefully im getting Be in a few months when its on the exchange so I will be ADSL2 bound. Then I will see if I can test between their router and the 2700HGV to see how they compare on ADSL2.

I have flashed and now can't access router via http://home or via http://192.168.1.254

any one know why?

Thankz.

[nicotine]

Any one know how to change the MTU settings on a Unlocked 2700HGV?

I got the router from ebay unlocked and all features seems to be working well including the Wireless power level 10 but as mentioned had to have the interent up and running until 5-10 will show up. The default 1500 is not the best MTU for my ISP as I have tested it to be 1458.

I notice there is traffic sharping so is that realted QoS? Any one know if the 2700HGV supports QoS? As I have an Asterisk server at home also that can do with QoS.

DNS Poisoning - does this also require the manual keycode to be entered?

Any one know how to change the MTU settings on a Unlocked 2700HGV?

I got the router from ebay unlocked and all features seems to be working well including the Wireless power level 10 but as mentioned had to have the interent up and running until 5-10 will show up. The default 1500 is not the best MTU for my ISP as I have tested it to be 1458.

Originally Posted by nicotine

As I understand it (could be wrong), But its probably best to keep your ROUTER MTU large, and make sure the MTU is set optimally on your endpoints (ie PCs).
If your PC MTU is set to 1458 and your Router is at 1500, packets will sail through the bigger hole with no fragmentation and little degradation.
But if your PC MTU is 1500 (common with ethernet) and your Router is 1458 then you will get upload fragmentation all the time.
Think of MTU as Pipe-Diameters and it all makes sense (I think).

This is slightly different to the USB/Dial-up modems, where the MTU determines the actual packet size. A router is one-hop away, and Packet size is set by your Ethernet adapters (or VPN Adapter if you have one)

I have had no luck getting into this box.. so gonna throw in compactor...

I would advise NOT to flashing unless you really need to..

Brilliant. Everything is how it was sposed to be. Thankyou

Hi,

I have just flashed my BT2700 HGV, with the recovery_425.2sp file, and now I just get a 404 error page, cannot be found..

Any ideas if i can get this back now or is it scr**ed?

Cheers
Drew

[m-tek]

Bit more info needed ..Can you access the router ?? If so have you run setup?
Tell us what exactly you have done ??

m-tek

[Alex Atkin]

Router arrived, flashed the firmware according to this thread and everything works great. Not checked the range on the WiFi yet but the responsiveness of my connection on this router is brilliant.

Im now up to a 6336kbit sync with 6dB SNR. The real test will be the evening when the sync always would drop by 1Mbit or more presumably due to more crosstalk on the lines when everyone gets back from school/work. Then again, I NEVER had a sync this high before and it hasnt even dropped yet (touch wood).

If it manages to stay this high we are talking a 2Mbit improvement in my BRAS profile. Even if it drops thats between a 1-1.5Mbit improvement unless something REALLY screwy happens in the evening. Im VERY impressed.

Also, the firewall settings on this router are just amazingly simple to setup.

My only complaint is the web interface lags a bit when you open each page so its making my homepage laggy as it pulls the stats in to create a 10 second average download speed. I take it this router has no SNMP support?

Oh and one last thing. Does anyone have a spare vertical stand, its missing from this one and I really could use it.

[Mongoose]

DNS Poisoning - does this also require the manual keycode to be entered?

Originally Posted by lordy3

No, just run the poisoning as mentioned previously and all should be well.

[patioheater]

Hi,

I have just flashed my BT2700 HGV, with the recovery_425.2sp file, and now I just get a 404 error page, cannot be found..

Any ideas if i can get this back now or is it scr**ed?

Cheers
Drew

Originally Posted by wmguk

Sounds to me like you might have a manual ip set on yer pc, set it to dhcp or automatically set ip address

Then login with 192.168.1.254


@Alex, they are bloody good ain't they

[Alex Atkin]

My friend on BT isnt very happy because he has the none-wireless speedtouch which syncs slower than I used to get. Then again, he is slightly further from the exchange. Still, if he wasnt planning to get Sky Broadband id suggest he get one of these, I mean he wouldnt even need DNS poison or flash the firmware presumably being on BT?

As to the 404 problem. I noticed after I flashed the firmware when I first connected it asked me to set the password, which I did. It then presented me with a 404 error page. All I did was go back to the main router page (by typing its IP address in the URL) and all was well.

[patioheater]

Perhaps you should try and talk him out of Sly BB, lots of unhappy customers

[Alex Atkin]

Well another person I know just got it and it seemed to be running better than my ISP, which was top rated when I joined a few months back. (UKFSN aka enta.net) Enta.net is complete garbage for the past month, their centrals are almost permanently overloaded so that nomatter what you sync at you get between 1-3Mbit. Just now I found by BRAS is up to 4Mbit but im stuck at 3.2Mbit max for downloading due to the central being dead. Not too bad but it will be down to 2Mbit by 10pm until about 2am.

Speaking of, I WAS going to restart PPP to try to get another central but I cant find any way to do it. Is there a way to disconnect/reconnect without rebooting the whole router? Id rather not resync because im trying to bully the BRAS profile into increasing.

Just some thoughts on trying to hack into these things?

Anyone looked at the communication between the router and the bt provisioning servers (Presumably, every so often the Router tries to connect to a BT server. This then has the ability to update/unlock the machine and reset the login.

I'd be very surprised if the comms wasnt locked down some how, or just SSL encrypted, but it might be interesting to sniff the traffic of a 2wire getting reset??

Problem is how would one sniff it? Especially it being an ADSL device?
Maybe set up a Reverse Proxy (Apache) , on the internet that just serves pages from BT provisioning servers,
then adjust the 2wire dns to go through the proxy.
Then monitor the traffic & check Apache Logs??
I'd do it but work has picked up at the moment. If anyone is feeling bored
Of course SSL will throw a spanner in the works.

[Alex Atkin]

Im confused, why would we need to? At best that would allow you to use the BT content blocking stuff but I doubt you can enable the different wireless transmit powers that way or anything else not normally available on the BT firmware.

The VoIP is pointless because you HAVE to be a BT customer to subscribe to their VoIP service anyway. Im sure once someone gets VoIP working it will work just as well on the SBC firmware if not better than the BT firmware.

Incidentally my line STILL loses ~1Mb during the evening. :-( Around 7pm I lost all connectivity and had to force a resync because SNR was -1dB. Im down at 5152kbit now. Its an improvement but still quite strange it would drop that much.

[patioheater]

Incidentally my line STILL loses ~1Mb during the evening.
Yep mine does too, something to do with overhead cables I think.

Guess there's no way to back up the settings guys? I want to try one of my version 2's to see if there's much of a difference and I'm too lazy to do all my ports again.

@Lordy keep up the informative ebay emails lol

Basically I did the flash, and it did not display the redirection page, my IP address is showing the default gateway as 192.168.1.254 so i know i am trying to access the correct ip address, also tried http://home/ and all the other variasions (sp)

Its just totally knackered now...

Im confused, why would we need to? At best that would allow you to use the BT content blocking stuff but I doubt you can enable the different wireless transmit powers that way or anything else not normally available on the BT firmware.

Originally Posted by Alex Atkin

Thats exactly the point. If you do a strings dump of the firmwware you can see a script that had many examples of commands that configure VIOP ports, etc etc.

You really need to do a strings on the BT firmware to get an idea of the possibilities.

Its just a basic firmware, with lots of script commands to set up the VOIP ports, user names etc.

If the provisioning servers send these commands down the wire then its a possible way to get more out of the routers. eg set up VOIP ports for different SIPs (or maybe even change target SNR Margin)



The BT provisioning servers have the capability to reset the user ID and various other things.
This is either by commands comming down the wire OR by data triggering specific functionality on the web server that then calls the preset commands internally.

The latter way is more secure, but less flexible. (from a remote management POV).
If it is done this way then we are stuck.

The former way is less secure but might allow us to run commands to do various things (eg set up the VOIP for different providers) or adjust SNR Margin.

However the point, and this post, is irrelevant now - the BT management URL uses SSL, so no point sniffing it

echo "Setting TR069 management server"
cmc -set mgmt acs_url 0 "https://cwmp.cms.smehomehubrms.bt.com"
echo "Enable BT keycode"
cmc -set mgmt keycode 0 528Y-27G4-A222-22BJ-B22V
echo "Speeding up DSL connection time"
cmc -mapset mod params 9 "Search Type" 2

Content filtering doesnt interest me

[Alex Atkin]

Thanks for the detailed description, I realised after I posted it sounded like I was slamming the idea when in fact I was curious what it would enable. That, and I was in the foul mood yesterday - lol.
Its pretty much a given it was ssl though when you read the information about the router as they claim each router has its own ssl certificate and that would be the only really logical reason for them to have one. Im surprised there isnt more options you can change in the J pages though. Does changing the key code make any difference there or is the keycode purely just set the default stuff like PVC and other basic settings? Not that I have seen anywhere to change the keycode but I presume its doable from one of the wizards I avoided using.

Anyway, TR069 is a standard so there MUST be a way to implement it without sniffing just by reading up on it .
TR-069 was created by the DSL Forum to standardize the Wide Area Network (WAN) management of CWMP. Service Providers can now use one common platform to manage, through the Internet, all of their Customer Premise Devices, no matter the device nor the manufacturer.
Couldnt you just set the DNS for the provisioning server to a local PC, see which port it tries to connect on, setup some basic SSL support on that port and see what it asks? You arent sniffing whats going on but it might be totally obvious how to proceed once we see what its asking of the provisioning server.

So, dropping 1Mbit IS normal huh, interesting. Makes me want to turn off all the street lights from here to the exchange to see what happens as its the most likely cause. ;-)

The router really is tough though (keeping the connection even when the SNR is appalling) but its almost a negative too, because it didnt resync automatically when the SNR went to -1 and all data transfer stopped. That said, it should mean if I can get a reasonably good sync in the evening (which is not much lower than the BEST sync I ever got on other hardware at ANY time of the day) it should stay connected almost indefinately.

[Alex Atkin]

I managed to get my desired sync. I resynced halfway between when the SNR starts to drop and when it reaches the all time evening low. I managed to get a 5312 sync which drops to 3dB SNR in the evenings but the router is so rock solid it performs brilliant. Just goes to show the BT preset SNR of 6dB is totally stupid. Some routers cant handle as low as 6dB and some clearly (this one) can handle far lower.

Its a shame BTs equipment isnt a lot more clever than it is. Some routers still fail at 6dB and yet their equipment rarely tries for higher. Yet as the SNR is the lowest it ever gets in the evening then in theory THIS router will cope right down to 0dB although best to stick to at least 2dB just in case the line quality is lower one evening than usual.

Incidentally, can anyone who DOES have the ability to access the pages to change the SIP information on the router post the URLs so those pages so we can see if they exist in the other firmware? I suspect not but its worth a try.

It's a while since I looked at something like this, but anyone know if it'd be possible to connect the 2wire to another router (so that the traffic between the 2wire and BT's provisioning servers goes through your network), then use something like Cain & Abel (www.oxid.it) to do ARP poison routing, and intercept & decrypt the SSL traffic?

[divadiow]

yes, I would like to know how to change the SIP details- it would be so cool if we could use a service like sipgate with our 2700s

To all Talk Talk users- You have to change the MTU to 1400 to get access to secure sites.

[viaccess]

To all Talk Talk users- You have to change the MTU to 1400 to get access to secure sites.

Originally Posted by cjchenderson

Coincidentally, I was given this solution by a friend a couple of days ago, and I had been meaning to come here and share it. I have had this problem with my talktalk account using both the 2700 and the 1800 2Wire. I couldn't use msn and outgoing emails failed.

I was advised to force the Upstream MTU to 1376 (the default is 1500 which works OK with BT). To do this you need to go into the detailed configuration page: http://home/managment and select Configure Services from the Advanced menu. That has done the trick for me, so I hope it helps others who have had this same problem.

James

[tempearson]

There's some excellent info on this forum and I have successfully boosted my 2700 via the recovery_425.2sp firmware install.

However, I notice that this version does not seem to support MAC address filtering.

Does anyone know if it is there on a hidden page or any other way of activating MAC address filtering on this firmware version?

Thanks,

Tem

I tried this and my router is fried... power light flashes when booted then stuck on 3 red lights. Factory reset does nothing...Arse...

[tF82]

I'm trying to use my 2700 on AOL. Their usage policy only allows 500 hours a month, so leaving it hooked-up 24/7 is not possible if I don't wanna get capped.

It's a BT unit and I've got the unlocked SBC firmware. I have tried to set the "PPP on demand" parameter so it disconnects after X minutes of inactivity. No matter what I try it doesn't work. On the occasions it does disconnect (like an idle time of <5 min) it re-connects few minutes later. And this with no ethernet/wireless connections active, so it must be down to the router.

Is this option broken in this firmware version or something? I'd hate to have to trade my 2wire in for something else just for this.