How a Cable Modem Works

Web Diagnostic Interface Reference


SNMP Management


USRobotics Regulatory Information

How a Cable Modem Works

To understand the process by which a cable modem establishes connectivity, it is important to understand the protocols that are used by the various functions of the cable modem.

Protocols on top of DOCSIS
Internet Protocol (IP)
Data Link Encryption (BPI)
DOCSIS specific protocols
Transmission Convergence (MPEG-2) (downstream)
Media Access Control (MAC) (upstream)
Physical Layer Modulation (PHY)
Figure 2 - 1 DOCSIS Protocols

DOCSIS Protocol Stack

The various protocols that are used in the DOCSIS standard all have specific functions. The relationship of these protocols is shown in Figure 2-1. These protocols are the basis of operation for any cable modem. The lower four layers are specific to the cable data network (HFC plant) and are the foundation of communication between any cable modem (CM) and the cable modem termination system (CMTS.) The upper layers are protocols that are carried over the communication path established by the lower layers. Well known IP services, such as e-mail, Web, file transfer, and network news, are all presented as Transmission Control Protocol/Internet Protocol (TCP/IP) traffic. Other protocols such as IPX/SPX, AppleTalk, and NetBeui are possible, but since a vast majority of the Internet is based on TCP/IP, they are not shown here.

The lower four layers of DOCSIS are:

PHY - physical layer. This layer defines the modulation schemes used on an HFC plant. This layer is responsible for translating the raw signal found on the actual coaxial cable to and from digital information used by the upper layers in the protocol stack. The modulation schemes present on the coaxial cable can be 64 or 256 quadrature amplitude modulation (64- or 256-QAM) for the downstream and quadrature phase shift keying (QPSK), or 16-QAM for the upstream.

MPEG-2 - transmission convergence layer. All data that is present on the downstream is encapsulated into MPEG-2 frames. These frames can contain the actual video and audio data that is typically decoded and presented as TV images and sound. The MPEG-2 frames can also contain data that is decoded and presented as information available for computer usage (i.e., the Internet). Since all data, voice, audio, and Internet is encoded into MPEG-2 frames, the cable operator can combine all signals onto a single cable. This is how a cable provider can present both TV and Internet signaling on the same coaxial cable to the end user's home or office.

MAC - media access control layer. All data that is present on the upstream is managed by this section of the DOCSIS protocol stack. Since an HFC plant is similar to an Ethernet network in that all communication devices share the same cable, it is imperative that an orderly process exist whereby the CMTS can tell the cable modem when to transmit data and for how long. The MAC layer is the means of coordinating upstream traffic from the cable modem to the CMTS.

BPI - data link encryption. Since the cable network is a shared medium, there must be a method to protect user data from malicious usage. The DOCSIS standard defines Baseline Privacy Interface (BPI) as this method. BPI uses a public/private key exchange system to encrypt data that is transmitted between the cable modem and CMTS. The standard supported length of a BPI key is up to 448 bits, upgradable to 1024 bits.

Downstream and Upstream

From the moment a cable modem is powered on, up to the time end users are able to load their favorite home pages, a sequence of events occurs that involves all layers of the DOCSIS protocol stack. These events are specifically designed to ensure that the cable operator can provide a stable and reliable connection to the Internet. While a detailed discussion of the PHY, MAC, and MPEG-2 protocols is beyond the scope of this document, enough information is provided for a basic understanding of these protocols and how they interact.

QAM Lock

Assuming that the cable modem has properly powered up and that it passes all of its internal diagnostics, the first thing a cable modem must do is find a DOCSIS channel.

Practically every HFC plant in North America operates on a standard National Television Standards Committee (NTSC) frequency plan. This plan divides the entire spectrum into 6 MHz wide slices where the individual channels are present. If you tune your TV to channel 32, the cable box is actually receiving a 6 MHz wide slice of the total frequency spectrum allocated for channel 32. That 6 MHz is used to encode MPEG-2 frames containing video, color, and audio information that your cable box or TV decodes into picture and sound. If you graphed a single channel provided by the cable operator, it would look similar to Figure 2-2.

Figure 2 - 2 Single Channel

For each channel, repeat that graph and place them end-to-end, left to right, lowest frequency to highest frequency. That is the frequency spectrum for the cable operator. The far left edge of that graph is 5 MHz. The far right edge of that graph extends beyond 1000 MHz, but due to electrical and equipment constraints, it is uncommon for a cable operator to operate any channels beyond 900 MHz.

A DOCSIS channel can be graphed in the same fashion; however, instead of video, color, and audio information inside the MPEG-2 frames, it contains a data stream that represents computer information. Due to the "spectral shaping" of a data signal, there are no video or audio signals present, and the graph looks like Figure 2-3.

Figure 2 - 3 DOCSIS Channel

Every MPEG-2 frame, regardless of content, is stamped with a program identifier (PID). Any MPEG-2 frame with a PID of 0x1ffe (hex) is a DOCSIS data frame.

A cable modem will scan the entire frequency spectrum looking for a 6 MHz channel where the MPEG-2 frames are stamped with a PID of 0x1ffe. Once the cable modem finds a 6 MHz channel that carries this type of MPEG-2 frame, it achieves what is called QAM lock. Once QAM lock is obtained, a cable modem proceeds to the next step in the process.


Every CMTS continuously broadcasts three separate messages on every downstream channel that relates to the MAC layer. These messages are the synchronization message (SYNC), upstream channel descriptor (UCD), and bandwidth allocation map (MAP). A cable modem must continuously identify and decode these messages in order to properly transmit data onto the cable upstream path.

The SYNC message is simply a time synchronization message. It is used to provide a common time reference for all cable modems connected to the CMTS via the HFC network.

The next message is the upstream channel descriptor message (UCD). It is essentially a description of the upstream parameters including modulation, symbol rate, channel width, and frequency. Each upstream that is provided by the CMTS has its own set of these characteristics. For each upstream, a separate UCD message is broadcast by the CMTS. It is imperative that the cable modem uses these UCD messages to match the available upstream characteristics to its own capabilities and that a particular upstream is paired with a downstream.

The final message broadcast by the CMTS is the bandwidth allocation map (MAP). Like the UCD message, every upstream has its own MAP message. The MAP contains information that indicates when a cable modem can transmit and for how long. The SYNC message provides the time reference for these transmission opportunities. For the very first transmission that a cable modem makes, it must reference the MAP for a transmit opportunity called the initial maintenance opportunity - this is specifically reserved for cable modems that are just connecting to the network after power up.

Once a cable modem has received and decoded all of these messages, it "knows" the following:

  • Time reference (SYNC)
  • Upstream parameters (UCD)
  • When to transmit (MAP)

With this information, the cable modem proceeds to the next step of the ranging process, which is summarized as:

  • Fine adjustment of the time reference
  • Fine adjustment of the transmit frequency
  • Fine adjustment of the transmit power

The process of ranging is reiterative. The cable modem will use the SYNC, UCD, and MAP messages to determine when and how it transmits information on the upstream. The CMTS will see the cable modem transmission and determine the time offset from when it sent the MAP to the cable modem, the exact frequency of the incoming transmission, and the power level of the incoming transmission. The CMTS will then send a ranging response to the cable modem with instructions to adjust the timing, frequency, and power level of the cable modem transmission. This exchange repeats until the CMTS and cable modem have properly adjusted the timing to within 1 microsecond, the frequency to within 10 Hz, and the power to within .25 dBMV.

During the length of time that a cable modem is actively connected to a CMTS, the CMTS periodically repeats this process. This is called periodic maintenance and is determined by the configuration of the CMTS.

Once ranging is complete, any further transmission by the cable modem onto the upstream is negotiated based on a request from the cable modem that is granted by the CMTS. The cable modem will request bandwidth during a transmit opportunity as defined in the MAP message. The CMTS will grant the request and schedule a unique opportunity for the cable modem to transmit. This process takes place on a time scale of microseconds. As you can imagine, coordination of time and opportunity is critical. This is why the SYNC message is so critical to upstream communication.


Now that the cable modem has established the lower layers of communication with the CMTS, its next step is to establish Internet Protocol (IP) connectivity. This is done through standard Dynamic Host Configuration Protocol (DHCP) procedures. The cable modem broadcasts a DHCP request. The CMTS will forward this request to a DHCP server located on the cable operator's network. The DHCP server will, in the most basic of systems, register the cable modem by looking at its unique Ethernet MAC address (different from the MAC layer in the DOCSIS protocol model) and assign to it an IP address from a pool of IP addresses. This pool of IP addresses and related configuration is called a scope. The DHCP response, containing the IP address, default gateway, and IP net mask, is then forwarded by the CMTS to the cable modem.

DOCSIS Configuration File

In addition to this basic IP information, the DHCP response will also contain DOCSIS-specific information necessary for basic cable modem operation:

  • TFTP server IP address - for configuration files
  • DOCSIS configuration file name
  • Time-of-day server (optional)
  • Cable operator network-specific information (optional)

The Trivial File Transfer Protocol (TFTP) server is located on the cable operator's network, and this is where the various DOCSIS configuration files and cable modem firmware images are maintained. These configuration files specify operating parameters for the cable modem. The most basic configuration file simply enables the cable modem and declares a maximum available bandwidth for both the downstream and upstream. In more complex cable systems, these configuration files can be customized for specific vendor's modems, certain classes of service, special operating instructions such as traffic filters and to initiate firmware upgrades of cable modems.

Once the cable modem configures itself with the IP address provided by the DHCP server, it then initiates a file transfer to the TFTP server and downloads the configuration file specified. Once the cable modem has downloaded the configuration file, it is decoded and processed by the cable modem.

A DOCSIS configuration file is a critical component in provisioning DOCSIS cable modems. It is used to establish operating parameters that the cable modem uses at all times while it is connected to the Radio Frequency (RF) network.

In any configuration file that allows provisioning of a cable modem, a minimum of "Network Access: ENABLED" and a single defined "Class of Service" are absolutely required to enable the cable modem to send and receive Internet traffic. An example of a DOCSIS configuration file would contain the following:

This example does not contain any vendor-specific information or Simple Network Management Protocol (SNMP) specific information. To properly create a DOCSIS configuration file editor, you need to use the tools provided by your CMTS vendor.


Once the cable modem has acquired QAM Lock, properly ranged the upstream channel, received an IP address from the DHCP server, and processed the DOCSIS configuration file, it now must "register" with the CMTS. The registration process is simply described as a verification of all previous steps the cable modem has progressed through. A registration request is sent to the CMTS with a list of operating parameters that the cable modem has established. The CMTS parses this list, validates it, and then sends a registration response.

Data Ready

Now the cable modem is ready for data forwarding mode. Most cable modems designed today employ a bridge architecture. In the simplest terms, a bridge device is simply one that converts from one media to another. The two medias for a cable modem are: on the CPE side - Ethernet or USB, and on the RF side - coax. Any defined data traffic that is presented on one side of the cable modem is simply forwarded, or bridged, to the other side.