[funsec] Routers Part II

Chris Buechler funsec at chrisbuechler.com
Tue Nov 29 10:47:10 CST 2005

Dr. Neal Krawetz wrote:

>Hi folks,
>So, I've been benchmarking a bunch of different routers and I've
>noticed an oddity with Comcast "high speed internet" cable service.
>The service is supposed to provide 4Mbps download (6Mbps in select areas)
>and 384K uploads.
>All of my benchmarks show uploads around 355K, so 384K is definitely
>the correct upper threshold.  (Theoretical 384, actual 355.)
>I am in one of the 6Mbps "select areas".
>The interesting thing is, I can get over 6Mbps downloads, without
>uncapping my cable modem.  Comcast appears to use a threshold trigger
>at 9Mbps.  If you download, you can get up to 9Mbps.  But the second you
>cross that 9Mbps mark, they cap you and drop back to 6Mbps.
>(Benchmarks consistently show 5999Mbps - 6000Mbps after being capped.
>That is real 6Mbps, not theoretical.)

that's....interesting.  You sure this isn't a, umm, "feature" of your 
modem?  Or you aren't seeing something else and incorrectly attributing 
it to this? 

The way speed caps work on virtually all cable services (those that use 
DOCSIS, which is every major provider in the US at least) is through 
limiting at the modem.  When your modem syncs up with your cable 
provider, it pulls down a configuration file via TFTP which sets their 
transfer rate cap.  Not to say they can't rate limit elsewhere in their 
network as well, but that doesn't seem to be common.  The modem cap is 
not changed until the next time you power cycle the modem. 

In fact, a quick Google pulled up this from the Wikipedia entry for DOCSIS:
"As an example, Comcast, the largest cable provider in the United 
States, caps downstream bandwidth at 8 Mbit/s (except northern 
California, where it's 4Mbit/s) and upstream bandwidth at 384 Kbit/s for 
standard home connections. In some areas they are offering 8 Mbit/s 
downstream and 768 kbit/s upstream as a higher tier. These differing 
speed offerings are made possible by loading a different configuration 
file into the modem in different regions."

from:  http://en.wikipedia.org/wiki/DOCSIS

>So my questions are...
>(1) If they are supposed to cap at 6Mbps, why do they not enforce the cap
>until 9Mbps?  (Not that I'm complaining!  Just curious...)

If you're still using the same testing methodology, I'd blame it on 
that.  A better way to test sheer download speed would be to enable SNMP 
on the router, use something like monomon (http://monomon.matf.de/) that 
displays real time traffic graphs from SNMP on your screen (if you're a 
Windows user), and find as many download links as you can.  Keep hitting 
it until it stops going faster.  That's dramatically more reliable than 
one speed test site. 

>(2) Does the same cap trigger exist for people in Comcast 4Mbps areas?

I really doubt if there is a trigger as you describe on any Comcast 

>(3) Does the cap trigger exist for other cable modem providers?
>What provider, and what threshold?

the vast majority use DOCSIS caps on the modem, and they don't vary.  
That's the only type of cap on cable I've seen or heard of, in the US. 

>By the way:
>- The Linksys RV0041 (router with built-in VPN) is reported to benchmark
>  at under 1Mbps -- even over non-VPN connections.  Ouch.

again, if you're still using the same testing methodology, that's bunk.  
I have a *really* hard time believing Linksys would try to sell a 
gigabit switch/router that would only route 1 Mbps.  Not that I'd expect 
it to do gig speeds, but I would expect at least 10 Mb.  All but the 
cheapest broadband in the US at least is more than 1 Mbps, and has been 
for 5+ years at least. 

>- The Linksys WRT54G has a QoS threshold for WAN bandwidth.
>  The factory setting is "auto".  "auto" is 3Mbps.
>  If you manually crank it up to anything over 5Mbps (e.g., 10000), then
>  you can get 4.5Mbps over 802.11g.  (Wow!  Almost 10%!  Ugh...)

More like 20%, but it still sucks.  The best you can get over .11g is 
about ~25 Mb or so. 

I have a Linksys BEFVP41, WRT54G, and WRT54GS sitting at home (toys), 
you now have me to the point that I'm curious enough to pull them out 
and see what I can get out of them.  :) 


More information about the funsec mailing list