I would like to capture and decode the ADSL traffic going on between my modem to the CO equipment.

I am thinking of a setup similar to the one shown in this paper, but it seems the necessary hardware is totally out of my reach.

Alternatively maybe some high impedance tap to plug on some ADSL chipsets evaluation boards to do the hard job of demodulating etc ?

What would be the most cost effective option to go for ? Can someone suggest some simple schematics and low cost equipment that would do ? The capture needs not to be real time, and should be capable to see the exchange in both directions.

  • \$\begingroup\$ Actual tap can probably be a one tur link around one line wire or a balanced high impedance opamp able to handle the line speed. \$\endgroup\$ – Russell McMahon May 12 '12 at 15:23

In order to show this image but just a comment to last question . Yes it could be an ADSL modem, or not. You would then use the decoder to obtain the binary data and attempt to find the bit sync, byte sync and frame sync detector pulses and disable the Tx. Consider this clandestine patent for sniffing unknown HSTU-R's. enter image description here

I trust this answers all your original questions.

Note you need to examine the received analog signal level indicator to discriminate direction and verify modulation type only during negotiation period of dial-up otherwise would have to force the demodulator into a known state for ADSL over POTS vs ISDN vs AoP/AoI/AoL/SSDSL/HDSL/shared RNIS.

Obviously, you need design experience to communicate this state onto dummy HSTU-R receiver. Ideal is to use same model but that may not be most flexible model to work with. You also need good experience with Logic Analyzer and superior design skills in order to reverse-engineer this communication. Not for the faint of heart. I can say this with experience.

A complete design solution is beyond the scope of this forum.

| improve this answer | |
  • \$\begingroup\$ Why do you have two answers? \$\endgroup\$ – W5VO May 13 '12 at 19:51
  • \$\begingroup\$ 1st line explains that \$\endgroup\$ – Tony Stewart Sunnyskyguy EE75 May 13 '12 at 20:05
  • \$\begingroup\$ Tony, thanks for the additional hints. I fully believe when you say "not for the faint of heart"! The approach I am thinking know is to put in parallel to the line a 1:1 transformer used by the regular modems and record the signal in the time domain with a USB DSO in floating configuration. After capturing the initial training etc, I will attempt purely offline to demodulate all in software. Next step would be capturing some showtime. After looking at the relevant G.dmt and G.hs all the above sounds "very" entertaining, but after all it is just for the sake of learning something new. Cheers. \$\endgroup\$ – Prospero May 15 '12 at 21:27

The most cost effective means of capture this data requires ;

  • (1) HSTU-R module (any brand)
  • (1) Tektronics Active Differential Probe ( 1pF) or equiv.
  • (1) DSO > 1Msps with deep buffer for determining best place to capture on logic analyzer.
  • (1) Logic Analyzer with probes for Receive Data, Data Direction, Receive Clock. Packet received. and Signal Present.
  • (1) custom single ended to differential adapter from Dif. Probes to HSTU-R module matched impedance transformer.

Data Direction will need to be determined by your ability to measure the analog threshold of the signal to determine which direct it came from.

As a test engineer with experience in these tools, I have done similar things on T1 (DS1) @ 1.544Mbps but requires good logic analyzer experience for finding useful sync signals.

That's all I can say. Hope that helps and you are authorized to sniff these signals.

| improve this answer | |
  • \$\begingroup\$ Thanks for the hints. By HSTU-R you mean any ADSL "modem" right? In this case the idea would be trying to peek the digital signals in some place where they are decoded from the analog world, right? In this case I assume I would have also the problem that a normal modem would also try to handshake or expect some signal on the analog side before anythig can be decoded ? Or did I miss completely your suggestion ? Thanks. \$\endgroup\$ – Prospero May 13 '12 at 15:41
  • \$\begingroup\$ What is the "analog threshold" of the signal? Never heard of that! \$\endgroup\$ – Reversed Engineer Apr 2 '19 at 18:57
  • \$\begingroup\$ All RF Receivers and analog slicers ( comparators, limiters, buffers ) have an input threshold. \$\endgroup\$ – Tony Stewart Sunnyskyguy EE75 Apr 2 '19 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.