Teardown of "Xfiniy" SMC Networks SMCD3GNV 2.4/5Ghz Wireless Cable Modem Router

[raspberrypi]

This is the cable modem that comcast charges you 10$ a month for. It's a wireless 802.11N 2.4GHz and/or 5GHz wireless router and cable modem. I want to get better range out of this by making a yagi antenna for it or using the existing elements inside of it as the driven elements. But the fact that there are three needs to be sorted out first. I have a few ideas how it works. There are two mounted horizontally on the top and one vertically on the side near the base. The connectors are tiny coax connectors that have two conductors until it goes into a thicker part covered in heat shrink then it looks like just a one conductor wire, very tiny might just be a splice. All antenna elements are identical.

1. There is one receive antenna and two transmitter antennas for the two bands. That would increase efficiency of the transmitter?
2. Since they are the same size they might use two for the 2.4 and one for the 5? If so:
-Would you want the ones on the top to be the 2.4 and the side one to be 5GHz?
-Would you want one top and side to be the 2.4 giving you horizontal and vertical polarization, but that would seem detrimental to the 5 GHz?

The 5GHz is much faster but as soon as you have a wall or a ceiling in the way the signal goes down, so unless you are in the same room the 5GHz doesn't offer any advantage. So I was going to make the directional antenna on the 2.4Ghz, also because at 5GHz the antenna is so small it becomes hard to build because the size difference is in the elements starts to be well with in the margin of error when cutting small wires.

[raspberrypi]

Close ups of wires and ant elements.

Are these folded dipole or J pole antennas? It looks like they went through some effort to solder the wire at that specific point across both sides of the metal leaving a small closed gap. Why?

[ebclr]

Does not reivent the whell



https://www.amazon.com/Coredy-Extender-External-Antennas-CX-E120/dp/B01M6B0N2C/ref=sr_1_7?ie=UTF8&qid=1483588389&sr=8-7&keywords=wifi+ac+repeater

[raspberrypi]

Another thing I just noticed one of the top elements and the side elements have the same length wire running to them, which is about twice as long as the the third one. Could these be the 2.4 GHz antennas

[raspberrypi]

Does not reivent the whell



https://www.amazon.com/Coredy-Extender-External-Antennas-CX-E120/dp/B01M6B0N2C/ref=sr_1_7?ie=UTF8&qid=1483588389&sr=8-7&keywords=wifi+ac+repeater

But also costs 52$ plus what ever amazon feel like charging for shipping that day.
I also don't like that bullshit graph that compares apples and oranges. It compares wireless g to n, then compares that to their repeater. Wireless G has nothing to do with it. It claims that it increases 800Mbs vs 300 for the N spec device. Any piece of hardware is an extra hurdle. Thats like adding a plug in device to your Ethernet cable and expecting it to go faster.

I have watched enough of Daves videos to see through the bull shit. Its just a simple repeater.

[raspberrypi]

Here are some specs of the modem I found. It would be interesting to compare this to other modems to see which are faster. As far as the link to the repeater on Amazon it claims 800Mb/s speed but the source it connects to only goes to has "2.4GHz with 300/450 Mbps PHY data rate" at 18 dbm power output, so you couldn't get 800Mb/s if you wanted to.

I saw on hack 5 how the FCC limits the "watts" that can come out of these legally. Some wifi devices have more TX power but will use an antenna with less gain or a lower power receiver with a more efficient antenna. Some receivers can be adjusted to put out more watts, then you can just add a more efficient antenna giving you an equivalent of about 60 watts, more if you don't really care about the rules! Those kind of powers could give your wifi the range of a cell phone. I think the easiest way to boost signal would to choose a wifi device with a "detuned" antenna and put on a better one.

http://web.archive.org/web/20101207035322/http://www.smc.com/files/AX/SMCD3GNVFeatureSheet.pdf

HARDWARE FEATURES
 Platform independent – works with PC,OSX,
Linux, MAC, UNIX
 DOCSIS 1.0/1.1/2.0/3.0 compliant
 F type RF connector for cable network
interface
 Four RJ-45, 10/100/1000 Ethernet connector
for LAN
 Two RJ-11 connector for voice
 USB 2.0 Host Port
 One AC 110V power input
SOFTWARE FEATURES
Compliant to MCNS DOCSIS 1.1/2.0/3.0
specifications
Supports UDP, IP, ARP, ICMP, DHCP, TFTP,
SNMP, HTTP
Support G.711(A-Law, Mu-Law), G.723.1, G.
729A, G.729E voice compression
Voice Activity Detection(VAD) with Comfort
Noise Generation to save bandwidth
consumption
Support Auto-Jitter buffer adjustment to adapt
with the jitter of Internet traffic
Keep alive intervals and backup support to
reconnect to redundant server
DHCP, TFTP and ToD clients, provide device
auto configuration
Support G.168 Echo Cancellation up to 16ms
Support caller ID generation for USA, Japan
and China
No need to have fixed IP
Provide regional profile to accommodate the
regulation for different country
Support standard SNMP, MIB-II, Ethernet-like
MIB, Bridge MIB, RF Interface MIB, Cable
Device MIB, Baseline privacy Interface MIB
Supports TFTP software download
Power on self-diagnostic
Browser-based configuration and
management
Easy to install and friendly to user, just plug
and play
 COMPLIANT STANDARD
DOCSIS 1.0 1.1, 2.0, 3.0
PACKET CABLE 1.5
WiFi Alliance
UPnP
 UL 60950
 FCC Part 15 Class B
DIMENSIONS (W X L X H)
 218 x 212x 75 mm
 8.58.1 x 8.33 x 2.95 in
MAX. NUMBER OF CPES
64 (64 MAC addresses)
FILTERING
LLC: 16, IP: 64
RECEIVER
 Demodulation: 64/256QAM
 Max Speed: 38Mbps (64QAM)/43Mbps
(256QAM) per channel
 Input Frequency Range: 88Mhz to 1002 MHz
 DOCSIS 5120 Kbps/10Mbps (QPSK/16QAM)
 DOCSIS 41.4Mbps (64QAM)/55.2Mbps
(256QAM) bonding (DOCSIS) per channel
 Signal Level
 -15dBmV to +15dBmV (Automatically Gain
Controlled by CM)
 17dBmV
WIRELESS:
 16 MB DRAM
 2T3R 2.4GHz with 300/450 Mbps PHY data
rate
 TX power: 18dBm
 RX Sensitivity: -76dBm@54Mbps
 20MHz/40MHz channel bandwidth
 Hardware NAT, QoS, TCP/UDP/IP checksum
overloading. QoS: WMM/WMM-PS
 Supports L-SIG TXOP
 Embedded MIPS 74KC 500MHz with 64KB I
cache/32 KB D cache
 Legacy and high throughput modes
 Reverse Data Grant (RDG) support
 Dynamic Frequency Selection (DFS/DFS2)
 16 Multiple BSSID
 Security: WEP-64/WEP-128/TKIP/AES/WPA/
WPA2/HWWAPI
 WPS (WiFi protected setup) PBC, PIN
TRANSMITTER
Modulation
 64/256QAM
 TDMA: QPSK, 8QAM, 16QAM, 32QAM,
64QAM
 S-CDMA: QPSK, 8QAM, 16QAM, 32QAM,
64QAM,128QAM
Max Speed
Over 120Mbps with 4 bonding upstream
channels
Frequency Range
5 to 42MHz (edge to edge) DOCSIS
Bandwidth
0.2, 0.4, 0.8, 1.6, 3.2MHz
TDMA: 200, 400, 800, 1600, 3200, 6400 kHz
 S-CDMA: 1600, 3200 and 6400 kHz
 Signal Level
 +8dBmV to +58dBmV (QPSK)
 +8dBmV to +55dBmV (16QAM)
 TDMA:
 +8 to +54 dBmV (32QAM, 64QAM)
 +8 to +55 dBmV (8QAM, 16QAM)
 +8 to +58 dBmV (QPSK)
 S-CDMA:
 +8 to +53 dBmV (all modulations)
 (Output level of CM can automatically
controlled by CMTS through power ranging
function), Step: 1dB
 Output Return Loss
 > 6 dB (5-42 MHz) and (91~857 MHz)
TELEPHONY
 Supervisory Voltage: 48V dc nominal
 Maximum Loop Length: 1500 ft (457M) of 26
AWG (0.4 mm) wire
 Ringing Load Capacity: 5 REN per line
 Programmable Interface for Worldwide: Select
by country code and modem config file
 Protocol
 NCS/MGCP 1.0 for PC 1.5
 SIP RFC3261 for PC 2.0 (in later software
release)
 CODEC
 G.711A, G.726, G.728, G.729E, T.38, G.722
 Fax Support & Fax Relay over IP: T.38
LED
Front Panel: Power, US/DS, Online, WiFi, Tel 1,
Tel 2, Battery
Connector Side: Active Ethernet LAN for 4 port
OSS
Protocol: ICMP/SNMP V1, V2c, V3
MIB: MIB II / MCNS MIB/Hitron Proprietary
MIB, PKT-SP-MIB-EXSIG1.5-I01-050128
BATTERY BACKUP WITH LITHIUM BATTERY
CELLS
2600mAH - 5hrs operation and 8 hrs standby
POWER
Input DC: AC 110V
Consumption: TBD
ENVIRONMENT
Operating temperature
Regular Model 32 F (0 C) to 104 F (40 C)
Operating humidity
 10% to 90% (Non condensing)
Storage temperature
 -4 F (-40 C) to 140 F (80 C)
Surge Protection
 On RF Input shall sustain at least 4.5 kV
 On Ethernet RJ-45 shall sustain at least 3KV.