How to uncap Docsis compliant Cable Modems


There are usually two network configurations. (1) The PC is directly connected to the cable modem. (2) The PC is connected to a NAT router, whose WAN port is then in turn connected to the cable modem. All of the following steps apply to both cases, except the final one that deals with TFTP. Iíll explain the issues with this later.


Every time the cable modem is powered on, it looks in its configuration file for the address of an TFTP server and for a file name. This file is the Docsis configuration file that, among other things, sets a cap for the modemís download/upload bandwidth. The cable modem then retrieves that file and connects to the backbone.


How do we uncap it? Simple. Weíll download the docsis config file, edit it to change the cap parameters, then trick the cable modem in thinking our PC is the TFTP server so it then retrieves our copy of the docsis file.


Thereís a bit of work involved for this. First, we have to find out the TFTP server and file name used by the cable modem. For this we can use the docsisDiag utility ( This application, along with all others, is included in the file. Run docsdiag.bat. It uses SNMP to return many of the modemís parameters. Among these, the one we need are:


Configuration TFTP Server††††††††† = (replace this with yours throughout in the doc)

Configuration filename††† = isrr.bin (replace this with yours throughout in the doc)




IP fragments created††††††††††† = 0

IP††† =

IP address. = ††(the IP address of the cable modem, (replace this with yours throughout in the doc)†††† = 2


This application works as is in many cases. If not, please refer to the DocsDiag - DOCSIS cable modem diagnostics.htm file in the same directory. It has a lot of help on how to make it work for different modems.


Note that you might now go to and see some of you modemís parameters.


Now from a DOS prompt type:

tftp -i GET isrr.bin

You just downloaded the docsis configuration file from your ISP. Now itís time to edit it to change the modemís cap. This is done by using the Cisco Docsis configuration software in the docsisConfig directory (also available from Before running ConfigEdit.bat youíll need to edit it and follow the instructions contained there. Then execute ConfigEdit.bat and open the .bin file you TFTP'd. Go to the "Class of Service" tab. Voila'. Change the Max DS Rate to 7MB (mine doesn't seem to go higher). Save.


We will now need to have the cable modem think we are the ISP and retrieve our version of the file by running our own TFTP server.


This is the point where our network configuration is important. Here are the two cases. Both assume weíre running Windows 2000.

1.     PC Directly Connected to Cable Modem

Configure your PCís TCP settings for:


IP: with the ISPís tftp server)


Gateway: with your cable modemís IP address)

don't worry about the DNS...


When it's done change your TCP settings to use DHCP again, without. Check or with the docsDiag utility. Your speed limit should now be updated.

2.     PC ŗ NAT Routerŗ Cable Modem

Set your Router not to use DHCP but to use:

IP: with the ISPís tftp server)


Gateway: with your cable modemís IP address)


Youíll now have to configure the Router to send all traffic to your PC. LinkSys does this by configuring your PC for the DMZ setting. Other routers may be different. All that should be needed is to either forward all external traffic to your PC or to make your PC visible to the other side of the firewall.


Configure your PC with a static IP address in a range used by your router. Ex. If your router is at then configure your PC for:





Now add an additional IP address to the TCP settings in your PC:

IP: with the ISPís tftp server)



don't worry about the DNS...


This is done because youíll have to tell you TFTP server to listen on the latter address.



You shouldn't have to reboot. Place your modified copy of the isrr.bin (replace this with your name) in the tftpd directory (also available at If in your case the docsdiag showed it inside a subdirectrory you'll have to create one here. Start tftpd32 server. Go to Settings and set the Security to None. Increase the timeout to 20secs and the Max Retransmit to 6. Choose to translate Unix filenames. Make sure it's base directory point to where the isrr.bin is. Ok it. If you fall in case (2) make sure you set IP address in the Server Interfaces.


We now have to start filling the routing tables in the devices with our bogus data. So start pinging your cable modem, the TFTP IP address, and if applicable, your router. Do this for a couple of minutes. Now power off the cable modem (I usually wait a few seconds just to be sure) and then power it back on. Then immediately start pinging your cable modem until the config file has been transferred. After the traffic lights blinks the first time you should see that your tftp server is sending it your file...!


Now reconfigure your Router for DHCP (if case 2), and then reconfigure your PC to DHCP.


Youíre done!


Youíll have to repeat this procedure every time the modem is powered off.