Posted on 4 Comments

Virgin Media Hub 3 Crap & Router Upgrades

I posted a while back a teardown of the VM Superhub 2 router, as VM has “upgraded” to a rebranded Arris TG2492S/CE CM. Alas Virgin Media in their wisdom have decided that simple router features like being able to change the LAN subnet & DHCP server range are far too complex to trust to the Great Unwashed, so they’ve removed them entirely from the firmware, and locked the local LAN onto the 192.168.0.0/24 range.
As my network is already numbered in the 10.0.0.0/16 range, with several statically addressed devices present and other systems relying on these static assignments, using this router would have meant renumbering everything.

Luckily Virgin had the decency to leave the “modem mode” option in the firmware, effectively disabling the WiFi & routing functions & allowing the connection of a third-party router. Some searching for a suitable replacement for the core of my network turned up the Linksys WRT1900ACS. While I waited for this to arrive, some temporary workarounds were needed to make everything function well enough with VM’s crap router.

WRT1900ACS
WRT1900ACS

These routers have been designed as a modern replacement for the venerable WRT54G series of routers from some time ago, with full support for OpenWRT/DD-WRT firmware, and with a beefy 1.6GHz dual core CPU & 512MB of RAM I doubt I’ll be able to knock this one over with too much network traffic! This was pretty much the most powerful router I could afford, and should mean I don’t need to upgrade for a long time. (No teardown of this yet, as it’s taking care of the network at present. Maybe some point in the future I’ll take the plunge).

The stock firmware isn’t totally awful, and has some nice features, but I decided it needed to be replaced with DD-WRT for more security & future flexibility. I’ll leave the firmware flashing stuff for another post ๐Ÿ˜‰

Posted on 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

Mainboard
Mainboard

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

Atheros Gigabit Switch
Atheros Gigabit Switch

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-trafficย  class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

Intel Puma 5 CM CPU
Intel Puma 5 CM CPU

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

Atheros WiFi SoC
Atheros WiFi SoC

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

Atheros LAN PHY
Atheros LAN PHY

A separate Ethernet PHY is located between the SoC & the switch IC.

 

5GHz Radio Card
5GHz Radio Card

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

Power Supplies
Power Supplies

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

MaxLinear MXL261 Frontend
MaxLinear MXL261 Frontend

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post ๐Ÿ™‚

The Unknown One
The Unknown One

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

2.4GHz Frontend
2.4GHz Frontend

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Atheros 5GHz Radio
Atheros 5GHz Radio

Pretty much the same for the 5GHz radio, but with 3 radio channels.

Posted on 2 Comments

Cisco EA6700 / Linksys AC1750 Router

Cisco EA6700
Cisco EA6700

Since the boat was still running it’s internal network on 10/100M speeds, an upgrade was decided on, the internal WiFi signal strength was also pretty poor further than a few feet from the NOC.

The new router is a Cisco/Linksys AC1750 model, with gigabit networking, and full 802.11ac 2.4/5GHz Wireless. This router also has a built in media server, print server, USB3 & USB2.

PCB Overview
PCB Overview

Teardown time! Here’s the router with the cover removed. Most of the fun stuff is hidden under the shields, but these aren’t fully soldered down & the covers are removable. The 6 antennas can be seen spaced around the edge of the housing, the main CPU is under the large heatsink upper centre. The radio power amplifier stages are underneath the shields, while the main RF transceivers are just outside the shields.

2.4GHz Transceiver
2.4GHz Transceiver

Wireless N is provided by a Broadcom BCM4331, this provides full dual-band 3×3 802.11n support. Being 3×3 it is actually 3 separate transceivers in a single package, to get much higher throughput rates of 600Mbit/s.

5GHz Transceiver
5GHz Transceiver

Wireless AC is provided by it’s sister IC, the BCM4360, with throughput speeds of 1.3Gbit/s. Both of these transceiver ICs connect back to the main CPU via PCI Express.

5GHz Power Amplifiers
5GHz Power Amplifiers

To get increased range, there are a trio of Skyworks SE5003L +23dBm 5GHz power amplifier ICs under the shield, along with the TX/RX switching & antenna matching networks. Heatsinking for these is provided by a sink screwed to the bottom side of the PCB. The outputs to the antennas can be seen at the top of the image.

2.4GHz Power Amplifiers
2.4GHz Power Amplifiers

The 2.4GHz section is fitted with a trio of Skyworks SE2605L +23dBm 2.4GHz power amplifiers, with a similar heatsink arrangement under the board. Unlike the 5GHz section, the 2.4GHz antenna feeds are soldered to the PCB here instead of using connectors.

Main CPU
Main CPU

The main CPU is a BCM4708 Communications Processor from Broadcom, as for the other Broadcom chips in this router, very little information is available unless under NDA, but I do know it’s a dual core ARM Cortex A9 running at 1GHz, with built in 5-port gigabit ethernet switch.

CPU RAM
CPU RAM

Working RAM for the processor is a Hynix H5TQ2G63DFA 256MB part.

More to come on the installation of the new networking, with it’s associated 4G mobile gateway connection system.

73s for now!