Adventures in MoCA

I've been seeing this technology around for a few years now, but I've never decided to start playing with it until a Verizon Home Fusion cantenna, that uses MoCA, was given to me. Which by the way, are extremely well-built and complex devices in my opinion... but I'll write about that in an article to come. One of the reasons I've never decided to get into using MoCA is because, on paper, it has no real benefit over Ethernet. In fact, it has some clear disadvantages. With that said, I have always opted to run Cat6a cable to every device in my house and office, especially since I use PoE. Enough about that though. My first tests with MoCA involved connecting an Arris modem which said it supported MoCA to the cantenna that was given to me and tried to see if they could talk. With my limited knowledge of MoCA, and locked down firmware, I couldn't figure it out. I started surfing the web for MoCA to Ethernet media converters, similar to a fiber optic Ethernet converter. I found these Actiontec (ECB6200S02) MoCA adapters and I decided to pull the trigger. The first test I did with them was simple, I just connected them to an already active cable TV line and checked to see if there was any degradation in the quality of the TV signal after I connected a network over the same cable. I connected my laptop on one end and my Raspberry Pi on the other end. I had network communication and no loss of quality. It makes sense because MoCA operates on a higher frequency than all of the other data pushed through the cable. Such as DOCSIS (the cable internet protocol), analog TV, digital TV, and voice. I found an excellent PDF by Robert Schaeffer that explains the technical details of MoCA and the frequency range it operates on here. You can find the frequency graph in the "MoCA Operating Characteristics" section on page 15 of the document. Not long after I got a network going with the connected devices, I started thinking. If these devices have a NIC, which they do, then they most likely have some configuration interface, so I cracked one of them open to see if I could find a serial port. Sure enough, there was a labeled "RS232" header! I used one of these USB serial cables to connect to it. I can't remember if I bought mine from Adafruit, but I most likely did, and they also have a link to the Prolific drivers for the device. I tried connecting it a couple different ways and on my second attempt, I got a response from the device! I had successful communication at a 115200 baud rate with PuTTY. Check out the picture below to see what pins I connected the RX, TX,  and ground wires to. Once you get a command line started, you can type "help" to see what all it can do.

This is what I was greeted with in the console after booting it up:




Bootloader: Apr  4 2016 09:29:32

Last Image: (0x00000000):
IMG 0x2FC10000 (2273528)
SHA1SUM   : 0E20A85A C60A2CA9 244E1363 9A18B016 96B0910D
Calculated: 0E20A85A C60A2CA9 244E1363 9A18B016 96B0910D

Booting from ramimage 0x2FD04164 (len=204696)
RESET_HISTORY=0x00000003
Detected 8MB flash
IDLE task created
ISR Stack: 0007CF38-0007DF68
CORE1: Using 1150 Mhz for LOF
CORE1: HiRF board detected

BRCM MoCA 2.0.  g_EndText=000290B0 g_EndBss=0005A328
Flash page=0x00000000
Compiled by hudson on Mon Apr  4 09:29:21 EDT 2016

Running startup.sh
Note: Parameter will take effect after next MoCA core initialization.
Note: Parameter will take effect after next MoCA core initialization.
Note: Parameter will take effect after next MoCA core initialization.
Note: Parameter will take effect after next MoCA core initialization.
busy=0 fail=0
Note: Parameter will take effect after next MoCA core initialization.
Note: Parameter will take effect after next MoCA core initialization.
Note: Parameter will take effect after next MoCA core initialization.
# Applying NV setting: mocap -x set --rf_band 2
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --bonding 1
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --brcm_bonding_seed 1
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --impedance_mode_bonding 1475
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --led_mode 1
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --max_tx_power_tune offset 0  0 475 offset 3                                                                                                                                                               500 625 offset 0  650 675 offset 2  700 825 offset 0  850 950 offset 1  975 1025                                                                                                                                                              offset 0  1050 1100 offset 2  1125 1475 offset 1  1500 1675 offset 0  1700 2125                                                                                                                                                              padding 0
Note: Parameter will take effect after next MoCA core initialization.
Applying NV setting: mocap -x set --rf_band 2
Note: Parameter will take effect after next MoCA core initialization.
CORE1: Loading Moca Core image...(9)
CORE1: Loading Moca Core image done.
CORE1: THIS Node MAC address: 4c:8b:30:ca:ae:7e
CORE1: Last Operational Frequency = 1150 Mhz
CORE1: MoCA Startup Successful.
CORE1: MoCA Version
CORE1: -----------------------
CORE1: firmware version  : 2.11.1.50
CORE1: mocad version     : 2.11.1.50
CORE1: HW version        : 0x680200c0
CORE1: bmoca version     : 2.0.0
CORE1: MoCA self version : 0x20
CORE1: -----------------------
IP link up
IP: 192.168.144.30 MASK: 0.0.0.0 GW: 0.0.0.0
CORE1: MoCA link is up after 18s of downtime

#

 

Here is the output for "help":

# help

3450 <addr> [ <value> ]                  -- Read/write 3450 register
arp                                      -- Show arp table

autoupdate <addr> <start_hour> <end_hour>-- Check and update firmware on an hourly schedule.
                                            The update will pick a random time between start_hour
                                            and end_hour (0-23) and check for an update once per day

bootimage [0|1]                          -- Force boot image to 0 or 1
cli-disable <all|<cmd> >                 -- Disable access to cli commands.
                                            "all" disables all commands except cli-enable.
                                            cli-enable must be disabled by specifying it explicitly
cli-enable <cmd>                         -- Enable access to cli commands
DCAP                                     -- DCAP commands:DCAP.02, GCAP.03,etc
dump [addr]                              -- Dump memory
dir                                      -- Directory listing
echo [string]                            -- Write [string] to output
eport-get-link                           -- Get link status
eport-get-stats [ reset ]                -- Get ether stats
eport-set-mode <0-12>                    -- Set ethernet mux control
eport-gphy-set-speed [ auto ] |
                    [<10|100|1000>
                     <full|half>]        -- Set GPHY to autonegotiate/10/100/1000MBps and full or half duplex
eport-gphy-set-pause <tx|rx|txrx|off>    -- Set GPHY pause frame mode which is advertised during auto negotiation
eport-mdio [-d <dev_addr>] <addr> [ [<bithigh> <bitlow>] <value> ]
                                         -- Read/write MDIO register
flash-get-id                             -- Get flash id
flash-dump [ addr ]                      -- Dump flash
flash-erase <offset>                     -- Erase a flash sector
flash-write-test                         -- Write a pattern to flash
GCAP                                     -- GCAP commands:GCAP.01, GCAP.02,etc
gpio-mode                                -- GPIO Mode to control power and MoCA LEDs
help                                     -- Display help
http-cmd-disable <all|<cmd> >            -- Disable access to commands over http.
                                            "all" disables all commands except http-cmd-enable.
                                            http-cmd-enable must be disabled by specifying it explicitly
http-cmd-enable <cmd>                    -- Enable access to commands over http
http-disable                             -- Prevent starting of web server
http-enable                              -- Allow starting of web server
http-mmp-disable                         -- Prevent mmp commands
http-mmp-enable                          -- Allow mmp commands
http-port [ port_number ]                -- Get/Set the HTTP port number
http-update-disable                      -- Prevent software update over HTTP
http-update-enable                       -- Allow software update over HTTP
ifconfig [ -stats ] | [ auto ] |
         [linklocal] |
         [<ipaddr> [<netmask> [<gw>]]]   -- Display or configure IP address
l1                                       -- L1 Interrupts
l2                                       -- L2 Interrupts
memf <addr> <bitlow> <bithigh> <value>   -- Write register field
mem <addr> [ <value> ]                   -- Read/write memory
ping <ip>                                -- Ping host
moca-buffers                             -- Display MoCA OS buffer stats
mocap                                    -- Moca stats and settings
ntp <ip>                                 -- NTP server address
nvram-avs [ <0|1> ]                      -- Get/Set AVS Enable setting
nvram-custom [B|b|S|s|d] [<data>]        -- Get/Set custom data
nvram-erase [all]                        -- Erase all NVRAM info except MAC Address.
                                            "all" Erase all NVRAM info
nvram-info                               -- Get NVRAM info
nvram-mac [ <mac-addr> ]                 -- Get/Set MAC address
nvram-moca                               -- Get MOCA NVRAM settings
nvram-runonce [ <0|1> ]                  -- Get/Set runonce setting
quiet <ON|OFF>                           -- Disable/Enable command line echo
rd-button-enable <0|1>                   -- Enable Restore Default Button
rd-button-time <seconds>                 -- Get/Set the hold time for the Restore Default Button
reboot                                   -- Reset the board
reset-button-enable <0|1>                -- Enable Reset Button
rfswitch <H|L>                           -- Set RF switch to High (1125MHz+) or Low (5-1000MHz)
script <filename>                        -- Run script
spi-get-config                           -- Print SPI configuration
spi-set-baud <rate>                      -- Set spi clk rate
spi-set-chipsel <0|1>                    -- Set spi chip select
spi-set-cpha <0|1>                       -- Set spi clk phase
spi-set-cpol <0|1>                       -- Set spi clk polarity
spi-set-dtl-and-dsclk <0|1>              -- Set spi user dtl and dsclk mode
spi-set-polled <0|1>                     -- Set spi polled/intr mode
spi-xfer [bytes-out] [x<num_bytes>]      -- Transfer bytes on SPI line
tasks                                    -- Print task info
temp                                     -- Print die temperature
tftp <server> [<filename> [<offset>]]    -- Tftp file into flash
time                                     -- Display current time
tpcap ...                                -- Test-port Capture
version                                  -- Display flash image version

After doing that, I was able to find that these Actiontec devices have their own web server built in with a convenient configuration page. Mine was at 192.168.144.30. From the configuration page you can set a MoCA password, frequecy range, channel and other fun stuff!

I will be updating this post with more info soon.