Table of Contents
DOCSIS sniffing notes
This short guide will explain how to easily sniff docsis traffic using pom-ng.
Finding the DOCSIS frequencies
To discover the DOCSIS frequencies, you can use input docsis_scan. Once started the input will scan through all the common frequencies and look for DOCSIS streams. If one or multiple streams are found, a corresponding input docsis will be added and pre-configured automatically.
Adding the DOCSIS input manually
If you already know the parameters of the DOCSIS stream you are looking for, you can add an input docsis manually and configure it accordingly.
Alternatively, you can also use an input dvb_c or dvb_atsc if you are going to sniff a european or a us docsis stream respectively. However these inputs are not optimised for DOCSIS and will be slower.
Sniffing multiple DOCSIS streams
With DOCSIS 3, the CMTS may bond multiple channels on multiple frequencies. By default, pom-ng assume that you don't have enough DVB cards to sniff all those streams at the same time. It will thus filter the traffic that is sent on multiple channels by default.
This filtering is done to prevent a huge memory usage cause by partial traffic and packet buffering (mostly at the TCP level).
However, if you are sniffing all the channels from a CMTS, you can disable this filtering. To do so, change the parameter filter_split_traffic to no of the protocol docsis.