Sniffing ADSL data exchange

Question

I would like to capture and decode the ADSL traffic going on between my modem to the CO equipment.

I am thinking of a setup similar to the one shown in this paper, but it seems the necessary hardware is totally out of my reach.

Alternatively maybe some high impedance tap to plug on some ADSL chipsets evaluation boards to do the hard job of demodulating etc ?

What would be the most cost effective option to go for ? Can someone suggest some simple schematics and low cost equipment that would do ? The capture needs not to be real time, and should be capable to see the exchange in both directions.

Answer 1

In order to show this image but just a comment to last question . Yes it could be an ADSL modem, or not. You would then use the decoder to obtain the binary data and attempt to find the bit sync, byte sync and frame sync detector pulses and disable the Tx. Consider this clandestine patent for sniffing unknown HSTU-R's.

I trust this answers all your original questions.

Note you need to examine the received analog signal level indicator to discriminate direction and verify modulation type only during negotiation period of dial-up otherwise would have to force the demodulator into a known state for ADSL over POTS vs ISDN vs AoP/AoI/AoL/SSDSL/HDSL/shared RNIS.

Obviously, you need design experience to communicate this state onto dummy HSTU-R receiver. Ideal is to use same model but that may not be most flexible model to work with. You also need good experience with Logic Analyzer and superior design skills in order to reverse-engineer this communication. Not for the faint of heart. I can say this with experience.

A complete design solution is beyond the scope of this forum.

Answer 2

The most cost effective means of capture this data requires ;

• (1) HSTU-R module (any brand)
• (1) Tektronics Active Differential Probe ( 1pF) or equiv.
• (1) DSO > 1Msps with deep buffer for determining best place to capture on logic analyzer.
• (1) Logic Analyzer with probes for Receive Data, Data Direction, Receive Clock. Packet received. and Signal Present.
• (1) custom single ended to differential adapter from Dif. Probes to HSTU-R module matched impedance transformer.

Data Direction will need to be determined by your ability to measure the analog threshold of the signal to determine which direct it came from.

As a test engineer with experience in these tools, I have done similar things on T1 (DS1) @ 1.544Mbps but requires good logic analyzer experience for finding useful sync signals.

That's all I can say. Hope that helps and you are authorized to sniff these signals.