Hub 3 / Compal CH7465-LG (TG2492LG) and CGNV4 Latency Cause

[Datalink]

Good Day Ladies and Gentlemen,

Greetings from the other side of the pond, so to speak.  Over the last few weeks I've been perusing various user forums across North America and Europe for issues related to Intel Puma 6 modem latency.  Of those forums, your Hub 3 stands out as yet another Puma 6 based modem where users see continuous latency no matter what site is used or what online game is played. Considering all of the problems that are on the go, the following information should be of interest to all Hub 3, Compal CH7465-LG and Hitron CGNV4 modem users.  There is much more to post regarding this, so this is a start, to alert VM users as to the real cause of the latency and hopefully engage the VM engineering staff, via the forum staff, with Arris.  I am surprised to see that there has been no mention on this board of users from other ISPs who are suffering the exact same issues with their modems, so, this may come as a surprise to some, and possibly old news to others.

So, the short story ........

The Hub 3 / Compal CH7465-LG (TG2492LG) & Hiton CGNV4 modems are Intel Puma 6 / 6 Media Gateway (MG) based modems.  These modems exhibit high latency to the modem and high latency thru the modem.  The latency affects all IPV4 and IPV6 protocols, so it will be seen on every internet application and game.  The basic cause is the processing of the data packets thru a CPU software based process instead of thru the hardware processor / accelerator.  It appears that a higher priority task runs periodically, causing the packet processing to halt, and then resume.  This is observed as latency in applications and in ping tests to the modem and beyond.  For the last several weeks, Hitron, along with Intel and Rogers Communications in Canada have been addressing the latency issue within the Hitron CGNxxx series modems.  To date, only the IPV4 ICMP latency has been resolved.  Although this is only one protocol, it does show that a Puma 6MG modem is capable of using the hardware processor / accelerator with good results.  Currently Rogers is waiting for further firmware updates from Hitron which should include an expanded list of resolved protocol latency issues.  For Arris modems, "Netdog" an Arris engineer indicated last week that Arris was onboard to address the issue for the Arris SB6190 modem.  That should be considered as good news for any Arris modem (read Hub 3) user as Arris should be able to port those changes over to other Puma 6/6MG modems fairly quickly.  This is not a trivial exercise and will probably take several weeks to accomplish.  Note that there is no guarantee at this point that it is possible to shift all packet processing to the hardware processor / accelerator without suffering from any packet loss side effects.  Time will tell if all of the technical issues can be resolved with the current hardware included in the Puma 6/6MG chipset.  Last night, Netdog loaded beta firmware on selected test modems on the Comcast Communications network.  As this was only done last night, it's too soon to tell what this version resolves and if it was successful or not.  Netdog has contacts with staff at Comcast, Rogers, Charter and Cox Communications to fan out beta versions and modifications for testing.  I'd say its time to add Virgin Media and/or Liberty Global to that group as well.

Recent activity:

Approx three weeks ago a DSLReports user, xymox1 started a thread where he reported high latency to an Arris SB6190 and illustrated that with numerous MultiPing plots.  This is the same latency that I and other users with Rogers communications have been dealing with for months so it came as no surprise.  As well as reporting via that thread, xymox1 took it upon himself to email several staff members at Arris, Intel, Cablelabs and others.  The result of that campaign was Netdog's announcement, last week, that Arris was fully engaged at resolving the issue.  That has led to last nights release of beta firmware, although as I indicated its too early to determine what the beta firmware resolves, if anything.

The original thread that xymox1 started is here:

https://www.dslreports.com/forum/r31079834-ALL-SB6190-is-a-terrible-modem-Intel-Puma-6-MaxLinear-mis...

Yesterday, DSLReports issued a news story covering the thread:

https://www.dslreports.com/shownews/The-Arris-SB6190-Modem-Puma-6-Chipset-Have-Some-Major-Issues-138...

Today, Arris responded:

https://www.dslreports.com/shownews/Arris-Tells-us-Its-Working-With-Intel-on-SB6190-Puma6-Problems-1...

That response was also picked by Multichannel.com

http://www.multichannel.com/news/distribution/intel-arris-working-firmware-fix-sb6190-modem/409379

This is more news likely to appear in the next few days as additional tech and news staff pick up on this issue.

Hub 3 observations:

Like many others using a Puma 6/6MG modem, Hub 3 users are experiencing latency when they ping the modem, or ping a target outside of the home, game online or use low latency applications.  The common misconception is that this is Buffer Bloat. It's not. Its most likely a case of the packet processing stopping while the CPU processes a higher priority task.  The packet processing is done via the CPU no matter what mode the modem is operating in, modem mode or router mode and no matter what IPV4 or IPV6 protocol is used.  Normally, the latency is just that, latency.  The exception are UDP packets. In this case there is latency and packet loss.  The result of that is delayed and failed DNS lookups, and poor game performance for games that use UDP for player/server comms or player/player comms.

Can this be fixed?

So far, it appears that the answer is yes.  Rogers Communications issued beta firmware to a small group of test modems in October.  This version shifted the IPV4 ICMP processing from the CPU to the hardware processor / accelerator, resulting in greatly improved performance in ping latency.  At the present time we are waiting for the next version firmware which should shift other protocols over to the hardware processor / accelerator.  That can be seen in the following post:

http://communityforums.rogers.com/t5/forums/forumtopicpage/board-id/Getting_connected/message-id/369...

The details and results of last nights beta release to the Comcast group have yet to be seen.

At this point there is enough reading to keep most staff and users busy.  My intention is to post some of the history leading up to this point and instructions on how to detect the latency and packet loss.  This is not thru the use of a BQM.  I had hoped to post this all at once but events are moving much faster than I had thought they would.  For now this should suffice to get the ball rolling.

Below is a link to a post with a couple of HrPing plots from my 32 channel modem to the connected CMTS.  This shows the latency that is observed and reflects what others have posted in this forum using Pingplotter and HrPing.

https://www.dslreports.com/forum/r31106550-

HrPing is one of the freebie applications that can be used to monitor the latency to and thru the modem. 

Pingplots with Pingplotter which show the latency from my modem to the CMTS can be found in the first two to three rows of my online image library at Rogers Communications, located below.  They are essentially what the BQM would look like if you were able to zoom into the plot to the point where you could see the individual ping spikes.  Those ping spikes are common to Puma 6 and Puma 6MG modems.

http://communityforums.rogers.com/t5/media/gallerypage/user-id/829158

 [MOD EDIT: Subject heading changed to assist community]

[Awal]

---

@shanematthews wrote:

---

---

They are unlikely to change their stance on non-VM kit on the network regardless of the CVE, it might speed up the hub4 process a little but probably not by any meaningful difference, it would take a massive wide scale DDoS attack for any real changes to be made sadly and thats not likely to happen, in this instance all you can really do is wait unless you plan on jumping ship to another ISP

---

Sadly you are probably right.

[Guybrush85]

---

@itinfocus wrote:

---

@cje85 wrote:

In the short term there's not much they can do, the supply of SuperHub 2ACs has run dry and there is not yet a Hub 4. They could allow customers to use their own modem from an approved list, but very few will do that. I think the best we can hope for is a Hub 4 in the near future, based on one of Arris' new products which use Broadcom instead of an Intel chipset.

---

In the short term you are probably correct. It's just such a shame that Virgin have completely ignored, denied, obfuscated and well generally lived up to there own customer service reputation for the past several months.

Serious issues were reported by the beta testers. Regular users have been complaining since the introduction of the Hub 3.0. 

More advanced users have since undeniably demonstrated the significant flaws in this modem.

Are we supposed to now just accept that any customer with a hub 3 can be denied ANY web access for an indeterminate amount of time?

Virgin have had the warnings, time and good will of customers warning them that this is not fit for over six months. The day the CVE is published cannot be accepted as day one of the fix. The six month head start they would have had if they took customer service seriously was long enough to have at least significantly started the process of finding an alternative.

Now quite honestly I don't care what brand damage this causes, the solution is simple. Either provide or allow the connection of another, customer sourced modem. I mean seriously how hard can it be for virgin to add an existing hub 2 from eBay to be added to a customers account? Validate any of the known Broadcom modems? Even tell us that this unit will be the Hub 4 you can self supply and we will eventually brand the living daylights out of it later?

We are all customers, we have ongoing and about to get much worse issues. It's not unreasonable to expect the company that many of us pay significant amounts of money to each month to look for a way of fixing this rather than accept just waiting on the next planned update.

---

Problem with this is 'not fit' is quite a broad term. Let's be honest, the average user with a Hub 3 will not notice anything at all. Heck, I know plenty of people out there with them and when I mentioned to them the latency issue, they thought I'd made it up.

In regards to the 6 months day statement... You should be under no illusion that Virgin are the people to come up with the fix, it's intel, then Arris/Compal who would then supply the firmware to Virgin where I'm sure they will need to amend it to fit their setup, so there was never going to be a quick fix. Obviously following where this is now across the pond, ICMP and DNS should be releasable as some kind of fix, albeit some say a mask of an issue. Depends what you read. As for an alternative, I would like to believe that somewhere they are looking at new kit and by they, I mean LG, but it will be surely based on Docsis 3.1 as a requirement rather than any bugs in the Hub 3.

The fix being simple is far from the truth. Activating old hub's from eBay, which SHOULDNT be on eBay in the first place as they are rented equipment is not going to happen. And LG allowing us to buy modems and activate them isn't just as easy as VM Service Desk clicking the "allow modem X". That alone would require testing etc, so again months away, by which point the hub 4 'may' be available anyway.

The above being said, I don't disagree that people should be discussing fixes for this, but until someone actually starts attacking Puma 6's out there and someone shouts out about it, I can't see them worrying too much. DDOS's happen on any connection. I'm more interested in what Intel has to say at this point.

[Adduxi]

---

@cje85 wrote:

In the short term there's not much they can do, the supply of SuperHub 2ACs has run dry and there is not yet a Hub 4. They could allow customers to use their own modem from an approved list, but very few will do that. <snip>

---

I would buy my own cable modem from an approved list if it was possible. I don't need a Router ......  🙂

[wotusaw]

This guy is not going to let them slink under the sofa and hope everyone goes to sleep and forgets about the appalling 'puma 6 chipset' cockup.

"As this DoS thing has been out in the wild now for 3 weeks without a advisory from Intel or anyone but Netgear I have decided to escalate this higher then basic CERT. I think having Intel guard the henhouse by being in charge of issuing CVE's on thier own products is not prudent. So I am going up the chain of command on the cybed side of the the DHS.
3 weeks is too long to iussue a advisory for something thats got public exploits. Its a ticking tome bomb that can be diffused if people are made aware the issue exists and they are given a clear understandign of the mitigations, risks and understanding of the underlying issue. This delay just exposes to risk and does not help."
'xymox1'

From DSL reports.
http://www.dslreports.com/forum/r31122204-SB6190-Puma6-TCP-UDP-Network-Latency-Issue-Discussion~star...

My own service provider has been trying to downplay this problem, the little playful munchkins.
But at the end of the day, you pay your money and you have every right to expect people who have gone to university, been trained, get paid oodles of cash...to get it right.

Anyway, I' playing a song for Xymox1....
https://www.youtube.com/watch?v=wQzn4a5qHT4

[shanematthews]

---

@wotusaw wrote:

This guy is not going to let them slink under the sofa and hope everyone goes to sleep and forgets about the appalling 'puma 6 chipset' cockup.

"As this DoS thing has been out in the wild now for 3 weeks without a advisory from Intel or anyone but Netgear I have decided to escalate this higher then basic CERT. I think having Intel guard the henhouse by being in charge of issuing CVE's on thier own products is not prudent. So I am going up the chain of command on the cybed side of the the DHS.
3 weeks is too long to iussue a advisory for something thats got public exploits. Its a ticking tome bomb that can be diffused if people are made aware the issue exists and they are given a clear understandign of the mitigations, risks and understanding of the underlying issue. This delay just exposes to risk and does not help."
'xymox1'

From DSL reports.
http://www.dslreports.com/forum/r31122204-SB6190-Puma6-TCP-UDP-Network-Latency-Issue-Discussion~star...

My own service provider has been trying to downplay this problem, the little playful munchkins.
But at the end of the day, you pay your money and you have every right to expect people who have gone to university, been trained, get paid oodles of cash...to get it right.

Anyway, I' playing a song for Xymox1....
https://www.youtube.com/watch?v=wQzn4a5qHT4

---

Its not really going to change anything though, even having a CVE out there won't mystically make them able to fix it, at this point i'm pretty sure its a hardware issue and that its something software cannot properly fix, there isn't a fix for the hub3 and it will be written off at some point, that being said we'll still need to wait for a hub4

[dcookster]

---

@Butler85 wrote:

---

@itinfocus wrote:

---

@cje85 wrote:

In the short term there's not much they can do, the supply of SuperHub 2ACs has run dry and there is not yet a Hub 4. They could allow customers to use their own modem from an approved list, but very few will do that. I think the best we can hope for is a Hub 4 in the near future, based on one of Arris' new products which use Broadcom instead of an Intel chipset.

---

In the short term you are probably correct. It's just such a shame that Virgin have completely ignored, denied, obfuscated and well generally lived up to there own customer service reputation for the past several months.

Serious issues were reported by the beta testers. Regular users have been complaining since the introduction of the Hub 3.0. 

More advanced users have since undeniably demonstrated the significant flaws in this modem.

Are we supposed to now just accept that any customer with a hub 3 can be denied ANY web access for an indeterminate amount of time?

Virgin have had the warnings, time and good will of customers warning them that this is not fit for over six months. The day the CVE is published cannot be accepted as day one of the fix. The six month head start they would have had if they took customer service seriously was long enough to have at least significantly started the process of finding an alternative.

Now quite honestly I don't care what brand damage this causes, the solution is simple. Either provide or allow the connection of another, customer sourced modem. I mean seriously how hard can it be for virgin to add an existing hub 2 from eBay to be added to a customers account? Validate any of the known Broadcom modems? Even tell us that this unit will be the Hub 4 you can self supply and we will eventually brand the living daylights out of it later?

We are all customers, we have ongoing and about to get much worse issues. It's not unreasonable to expect the company that many of us pay significant amounts of money to each month to look for a way of fixing this rather than accept just waiting on the next planned update.

---

Problem with this is 'not fit' is quite a broad term. Let's be honest, the average user with a Hub 3 will not notice anything at all. Heck, I know plenty of people out there with them and when I mentioned to them the latency issue, they thought I'd made it up.

In regards to the 6 months day statement... You should be under no illusion that Virgin are the people to come up with the fix, it's intel, then Arris/Compal who would then supply the firmware to Virgin where I'm sure they will need to amend it to fit their setup, so there was never going to be a quick fix. Obviously following where this is now across the pond, ICMP and DNS should be releasable as some kind of fix, albeit some say a mask of an issue. Depends what you read. As for an alternative, I would like to believe that somewhere they are looking at new kit and by they, I mean LG, but it will be surely based on Docsis 3.1 as a requirement rather than any bugs in the Hub 3.

The fix being simple is far from the truth. Activating old hub's from eBay, which SHOULDNT be on eBay in the first place as they are rented equipment is not going to happen. And LG allowing us to buy modems and activate them isn't just as easy as VM Service Desk clicking the "allow modem X". That alone would require testing etc, so again months away, by which point the hub 4 'may' be available anyway.

The above being said, I don't disagree that people should be discussing fixes for this, but until someone actually starts attacking Puma 6's out there and someone shouts out about it, I can't see them worrying too much. DDOS's happen on any connection. I'm more interested in what Intel has to say at this point.

---

It's vulnerable to a low bandwith DoS attack.  Not the same as DDoS and I think you'll find Intel have already pre-reserved a CVE so they are taking it seriously.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5693

[shanematthews]

"It's vulnerable to a low bandwith DoS attack.  Not the same as DDoS and I think you'll find Intel have already pre-reserved a CVE so they are taking it seriously.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5693 "

Taking it seriously and being able to fix it are two very different things 😛

---

 Also i see no mention of intel on that page, not to mention thats a 3 month old reserved ID

[dcookster]

---

@shanematthews wrote:

"It's vulnerable to a low bandwith DoS attack.  Not the same as DDoS and I think you'll find Intel have already pre-reserved a CVE so they are taking it seriously.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5693 "

Taking it seriously and being able to fix it are two very different things 😛

---

 Also i see no mention of intel on that page, not to mention thats a 3 month old reserved ID

---

Vendors reserve CVE's on mass.

Follow the link: http://www.dslreports.com/forum/r31122204-SB6190-Puma6-TCP-UDP-Network-Latency-Issue-Discussion~star...

[Guybrush85]

---

dcookster wrote: It's vulnerable to a low bandwith DoS attack.  Not the same as DDoS and I think you'll find Intel have already pre-reserved a CVE so they are taking it seriously.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5693

---

I know and I get that, but let's take that away for a second. The theory is that due to the low bandwidth required to bring it down, someone could potentially target a range of IP's using lesser bandwidth, thus this being a huge risk. Should this happen, I'm pretty sure it will be in the form of a DDOS.

You would have to be a complete idiot to perform such an attack from your own connection which is what it seems people are imagining. It's not WinNuke days, it's going to be some form of booter, botnet, shell etc.

When getting access to any of those is just a trivial as the DOS attack is on the modem, then to me, whilst this is a risk, it's not something that doesn't already happen.

As for the reservation of a CVE, this isn't them saying anything as far as I'm concerned, you need only look at the date stamp on it. I want to know what they're actually going to say in terms whether this is fixable etc. 

Where I find this issue is worrying is the very thing that brings it down could just be done through normal use of the modem. One user with several home security cameras was noticing the effect of this for example and BitTorrent has been mentioned as an example. I'm less worried that some teenager is going to take target me and take me offline at the moment.

[qpop]

Just a follow-up, having just had an engineer over, following my CEO office complaint:

• Engineers are aware of the issue and feeding back to higher-ups, though this seems to be falling on deaf ears (my words not his)
• He said his stock of 2ACs had been taken off his van.
• He called the local stores to check and was told there was no 2AC stock whatsoever (Leicestershire/East Mids)
• He said the only way it might happen is if he comes across one as he's doing an upgrade and holds onto it for me (I'm not holding out much hope here).

So there we go, no resolution, no positive outcome, just an annoyed customer queuing up with the rest.