MIB Viewer

Modem/MTA Bootfiles

Last updated September 10, 2026

A DOCSIS bootfile is a small binary configuration file a cable modem downloads over TFTP during provisioning. An MTA (Multimedia Terminal Adapter, the voice half of a cable voice gateway) uses a related but distinct file format, provisioned under PacketCable rather than plain DOCSIS. Both are written by hand as plain text, then compiled into the binary TLV (type-length-value) format the device actually expects.

Why SNMP matters here

A bootfile isn't a separate configuration language that happens to coexist with SNMP - much of it is SNMP. Every SnmpMibObject line in a config file sets a MIB object to a value, the same as an snmpset command would against a device that's already online - the difference is only that this one gets applied automatically during provisioning, before the device has an IP address to reach interactively. Reading a bootfile line by line is largely reading a list of pre-loaded SNMP SETs: knowing what a given OID does, and where to look it up, is the difference between editing these files by copying an example and actually understanding what each line changes.

Not every line is SNMP-based, though. DOCSIS also defines its own native, non-SNMP TLVs for common settings - service flows, baseline privacy timers, network access - which exist as their own encoding rather than as MIB objects. The worked examples below cover both kinds, and say explicitly which is which.

Installing the encoder

This guide uses rlaager/docsis, a widely-used open-source encoder for both modem and MTA files. Dependencies first, then build from source - there's no pre-built package for most distributions:

# Debian / Ubuntu
sudo apt-get install automake libtool libsnmp-dev bison make gcc flex git libglib2.0-dev libfl-dev

# RHEL / CentOS / Fedora
sudo yum install autoconf automake libtool glib2-devel bison flex net-snmp-devel
git clone https://github.com/rlaager/docsis.git
cd docsis
./autogen.sh
./configure
make
sudo make install   # optional - installs to /usr/local, otherwise run ./docsis from the build directory

The repository includes a mibs/ directory with the MIBs the tool needs to translate named OIDs (like docsDevSwServer) into their numeric form when you reference them by name rather than typing out full dotted OIDs by hand.

Compiling and decoding a modem file

Encoding a modem config needs a key file (a shared secret used to compute the CMTS MIC, a cryptographic integrity check) in addition to the config itself:

echo "mysharedsecret" > key.txt
./docsis -e modem.cfg key.txt modem.bin

modem.bin is the binary bootfile placed on the TFTP server and referenced (usually via DHCP option 67) for the modem to download during provisioning. To check what's inside a compiled file - useful for confirming it matches what you intended, or inspecting one you didn't write yourself - decode it back to text:

./docsis -d modem.bin

A known gotcha: quoting hex string values (things like 0x0011ee) causes the encoder to crash. The documented workaround is simply not quoting hex definitions, even though quoting plain string values is fine and often necessary.

A modem config, line by line

The file below is a complete, representative modem config - every line it contains, and what it does:

Main
{
        SnmpMibObject iso.3.6.1.2.1.2.2.1.7.16 Integer 1; /* ifAdminStatus */
        NetworkAccess 1;
        MaxCPE 1;
        MaxClassifiers 5;
        GlobalPrivacyEnable 1;
        BaselinePrivacy
        {
                AuthTimeout 10;
                ReAuthTimeout 10;
                AuthGraceTime 600;
                OperTimeout 10;
                ReKeyTimeout 10;
                TEKGraceTime 600;
                AuthRejectTimeout 9;
        }
        UsServiceFlow
        {
                UsServiceFlowRef 1;
                QosParamSetType 7;
                TrafficPriority 2;
                MaxRateSustained 5000000;
                SchedulingType 2;
                MaxTrafficBurst 8000;
                MaxConcatenatedBurst 8000;
        }
        DsServiceFlow
        {
                DsServiceFlowRef 101;
                QosParamSetType 7;
                TrafficPriority 2;
                MaxRateSustained 5000000;
        }
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.2.1 IPAddress 255.255.255.255; /* docsDevNmAccessIp */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.3.1 IPAddress 0.0.0.0; /* docsDevNmAccessIpMask */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.4.1 String "public"; /* docsDevNmAccessCommunity */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.5.1 Integer 2; /* docsDevNmAccessControl */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.6.1 String "@"; /* docsDevNmAccessInterfaces */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.7.1 Integer 4; /* docsDevNmAccessStatus */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.2.2 IPAddress 255.255.255.255; /* docsDevNmAccessIp */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.3.2 IPAddress 0.0.0.0; /* docsDevNmAccessIpMask */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.4.2 String "private"; /* docsDevNmAccessCommunity */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.5.2 Integer 3; /* docsDevNmAccessControl */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.6.2 String "@"; /* docsDevNmAccessInterfaces */
        SnmpMibObject iso.3.6.1.2.1.69.1.2.1.7.2 Integer 4; /* docsDevNmAccessStatus */
}

The interface line

SnmpMibObject iso.3.6.1.2.1.2.2.1.7.16 Integer 1 sets ifAdminStatus for interface 16 to up(1) - a standard IF-MIB object, not DOCSIS-specific. .7 is the column (ifAdminStatus) within ifTable; .16 is the specific interface's ifIndex. Which physical interface ifIndex 16 actually refers to is device-specific.

Native DOCSIS TLVs (not SNMP)

NetworkAccess, MaxCPE, MaxClassifiers, GlobalPrivacyEnable, and the BaselinePrivacy/UsServiceFlow/DsServiceFlow blocks are DOCSIS's own configuration TLVs, encoded directly into the bootfile rather than going through an SNMP object at all - there's no OID behind these specifically:

  • NetworkAccess 1 - allows the modem online at all; a config with this set to 0 provisions successfully but is denied forwarding.
  • MaxCPE 1 - the number of customer devices allowed to share this connection.
  • MaxClassifiers 5 - the maximum number of packet classifiers the modem will accept, controlling how many distinct traffic-matching rules can exist across its service flows.
  • GlobalPrivacyEnable 1 - turns on Baseline Privacy (BPI/BPI+) link encryption between modem and CMTS.
  • BaselinePrivacy - the encryption key-management timers: how often authorization and traffic encryption keys are renewed, and how long a previous key stays valid during rekeying, so encryption doesn't briefly fail during a routine key rotation.
  • UsServiceFlow / DsServiceFlow - the QoS definitions for this modem's upstream and downstream traffic: committed rate (MaxRateSustained, in bits per second), burst allowance, and scheduling type. A modem's actual bandwidth cap comes from here, not from anywhere in the SNMP side of the file.

The SNMP access rows

The twelve SnmpMibObject lines at the end are two rows of DOCS-CABLE-DEVICE-MIB's docsDevNmAccessTable (1.3.6.1.2.1.69.1.2.1) - the table controlling which management stations may query this modem over SNMP once it's online, and with what access level. Six columns per row, .1 and .2 at the end distinguishing the two rows:

  • docsDevNmAccessIp (.2) - the manager's IP address. 255.255.255.255 here is a common vendor extension recognized as equivalent to 0.0.0.0, meaning "any manager."
  • docsDevNmAccessIpMask (.3) - subnet mask paired with the address above.
  • docsDevNmAccessCommunity (.4) - the community string this row matches: public for row 1, private for row 2.
  • docsDevNmAccessControl (.5) - the access level. 2 is read (get/get-next only); 3 is readWrite - meaning this config grants the conventional split: public gets read-only, private gets read-write.
  • docsDevNmAccessInterfaces (.6) - a bitmask of which link-layer interfaces this row's access applies to, one bit per interface, most significant bit of the first octet representing interface 1. "@" is the ASCII character with value 0x40 (binary 01000000), so this bitmask includes interface 2 specifically, not a wildcard for every interface.
  • docsDevNmAccessStatus (.7) - RowStatus; 4 is createAndGo, the standard value for provisioning a new row immediately.

This table is formally deprecated in favor of SNMPv3 and the SNMP-Coexistence MIBs - but DOCSIS OSSIv1.1 requires modems to keep supporting it for backward compatibility with SNMPv1/v2c management, which is exactly why it still shows up in bootfiles written today.

Common Arris settings

Arris cable modems expose a proprietary management MIB, ARRIS-CM-DOC30-DEVICE-MIB, under 1.3.6.1.4.1.4115.1.3.4 - Arris is enterprise number 4115. The access-control portion of it, arrisCmDoc30Access (...4115.1.3.4.1.2), covers exactly the kind of settings a provisioning file typically touches:

SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.2.0 Integer 1; /* arrisCmDoc30AccessTelnetEnable */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.10.0 Integer 1; /* arrisCmDoc30AccessSSHEnable */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.9.0 Integer 1; /* arrisCmDoc30AccessHttpPwCtrl */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.5.0 Integer 1; /* arrisCmDoc30AccessHttpLan */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.6.0 Integer 1; /* arrisCmDoc30AccessHttpWan */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.3.0 String "example"; /* arrisCmDoc30AccessClientSeed */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.4.1.2.11.0 String "mypassword"; /* arrisCmDoc30AccessTechnicianPassword */
SnmpMibObject iso.3.6.1.4.1.4115.1.3.3.1.2.3.6.0 Integer 9; /* arrisMtaDevProvMethodIndicator */

(The trailing .0 on each OID is the standard SNMP scalar instance suffix - these are all single-valued objects, not table columns.)

  • arrisCmDoc30AccessTelnetEnable (.2) - enables/disables Telnet access to the modem.
  • arrisCmDoc30AccessSSHEnable (.10) - enables/disables SSH access.
  • arrisCmDoc30AccessHttpPwCtrl (.9) - controls whether the web management interface requires a password.
  • arrisCmDoc30AccessHttpLan (.5) / arrisCmDoc30AccessHttpWan (.6) - enable/disable the web management interface from the LAN side and WAN side respectively.
  • arrisCmDoc30AccessClientSeed (.3) - a seed value used in Arris's password-generation scheme for the device.
  • arrisCmDoc30AccessTechnicianPassword (.11) - sets the technician-level access password.
  • arrisMtaDevProvMethodIndicator sits under ARRIS-MTA-DEVICE-MIB rather than ARRIS-CM-DOC30-DEVICE-MIB - a related but separate Arris module for the MTA side of the device, using the same 4115.1.3.3 branch referenced again in the MTA example below. It reports which provisioning method the MTA registered with; 9 is gupiMacMta, meaning MAC-address-based GUPI provisioning rather than one of the other PacketCable provisioning flows this object can report.

Leaving Telnet, SSH, or the web interface reachable with a default or blank password is a real, documented exposure on this class of device - CVE-2014-4863 covers an Arris DOCSIS gateway disclosing its WiFi SSID and pre-shared key over SNMP using the default public community string. Setting these access objects deliberately, alongside a non-default docsDevNmAccessCommunity in the table above, is worth treating as a baseline rather than an afterthought.

Common Hitron settings

Hitron modems expose their own proprietary management MIB, HITRON-CABLE-MODEM-MIB, under enterprise number 8595, covered in MIB Viewer's database the same as ARRIS-CM-DOC30-DEVICE-MIB above:

SnmpMibObject iso.3.6.1.4.1.8595.2.1.2.2.1.2.1 String " "; /* hCmAccessEntryLabel */
SnmpMibObject iso.3.6.1.4.1.8595.2.1.2.2.1.2.2 HexString 0xc0; /* hCmAccessEntryFilterMask */
SnmpMibObject iso.3.6.1.4.1.8595.2.1.2.2.1.2.4 HexString 0xe0; /* hCmAccessEntryFilterValue */
SnmpMibObject iso.3.6.1.4.1.8595.2.1.2.2.1.2.5 String " "; /* hCmAccessEntryComment */
SnmpMibObject iso.3.6.1.4.1.8595.4.1.1.0 Integer 2; /* hCmRemoteManagementMode */
SnmpMibObject iso.3.6.1.2.1.2.2.1.7.16 Integer 1; /* ifAdminStatus */
  • hCmAccessEntryLabel / hCmAccessEntryComment - free-text label and comment fields on a remote-management access entry, left blank (a single space) in this example rather than filled in.
  • hCmAccessEntryFilterMask / hCmAccessEntryFilterValue - the filter byte pair defining which source addresses this access entry matches, in the same spirit as docsDevNmAccessInterfaces's bitmask earlier, but Hitron's own encoding rather than the standard one.
  • hCmRemoteManagementMode - the device's network operating mode; 2 is bridge(2), putting the device in bridge mode rather than acting as its own router.
  • ifAdminStatus - the same standard IF-MIB object from the modem example earlier, this time for interface 16 on the Hitron device specifically - not Hitron-specific itself, it just shows up here too since every DOCSIS device implements IF-MIB.

An MTA config, line by line

This example is for an Arris MTA specifically - the vendor-specific objects it sets belong to Arris's own ARRIS-SIP-MIB, not a cross-vendor standard. A different manufacturer's MTA uses its own MIB for the equivalent settings, with different OIDs entirely. The general shape carries over - a dial plan, per-line SIP credentials, a proxy/registrar address, a codec list - but the specific objects won't match a non-Arris device.

Main
{
    MtaConfigDelimiter 1;
    SnmpMibObject iso.3.6.1.4.1.4491.2.2.1.1.1.7.0 Integer 1; /* pktcMtaDevEnabled */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.2.0 String "0|911|[2-8]11[t]|011xxx.[t#]|xxx[t#]|xxxx[t#]|xxxxxxx[t#]|[2-9]xxxxxxxxx[t#]|[1][2-9]xxxxxxxxx[t#]|[9][2-9]xxxxxx[t#]|[9][2-9]xxxxxxxxx[t#]|[9][1][2-9]xxxxxxxxx[t#]|*xx.[t#]"; /* sipCfgDigitMap */
    SnmpMibObject iso.3.6.1.4.1.4115.10.1.3.0 IPAddress 67.58.160.108;
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.1.1.2.1 String "1234567890"; /* sipCfgPortUserName */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.1.1.3.1 String "1234567890"; /* sipCfgPortDisplayName */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.1.1.4.1 String "1234567890"; /* sipCfgPortLogin */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.1.1.5.1 String "o1OgBGacbCsyPqrrZMww"; /* sipCfgPortPassword */
    SnmpMibObject iso.3.6.1.2.1.2.2.1.7.9 Integer 1; /* ifAdminStatus */
    SnmpMibObject iso.3.6.1.4.1.4115.10.1.20.0 Integer 16384;
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.3.0 String "192.168.160.1;5060"; /* sipCfgProxyAdr */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.4.0 Integer 0; /* sipCfgProxyType */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.5.0 String "192.168.160.1;5060"; /* sipCfgRegistrarAdr */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.6.0 Integer 0; /* sipCfgRegistrarType */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.7.0 HexString 0x20008000; /* sipCfgSipFeatureSwitch */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.8.0 String "PCMA;PCMU"; /* sipCfgProvisionedCodecArray */
    SnmpMibObject iso.3.6.1.4.1.4115.11.1.9.0 Integer 20; /* sipCfgPacketizationRate */
    MtaConfigDelimiter 255;
}

MtaConfigDelimiter 1 and MtaConfigDelimiter 255 aren't SNMP objects or even DOCSIS TLVs - they're structural markers bracketing the PacketCable-specific section of the file, switching the encoder's parsing mode for everything between them. Everything else here belongs to one of two MIBs: PKTC-EN-MTA-MIB, the single CableLabs cross-vendor standard object (enterprise 4491), and ARRIS-SIP-MIB (enterprise 4115, branch 11), which covers everything SIP-signaling related.

  • pktcMtaDevEnabled - the PacketCable-standard MTA admin status, common to every vendor's MTA; 1 (true) enables the voice feature on this device.
  • sipCfgDigitMap - the dial plan: which sequences of dialed digits are recognized, and how long the MTA waits for more digits before placing the call. 911 and its regional variants match immediately without a dial-timeout delay; the remaining patterns cover 7, 10, and 11-digit North American dialing.
  • sipCfgPortUserName / sipCfgPortDisplayName / sipCfgPortLogin / sipCfgPortPassword - four columns of ARRIS-SIP-MIB's per-line table, one row per phone line (row 1 here). Username and login are both set to the line's phone number in this example - a common pattern, though the two serve different purposes (SIP URI identity versus SIP authentication) and don't have to match. Password is the actual SIP authentication credential, which is why it's the one random-looking string in the group.
  • ifAdminStatus - the same standard IF-MIB object from the modem example, this time for interface 9.
  • sipCfgProxyAdr / sipCfgRegistrarAdr - the SIP proxy and registrar server for this line, each given as an address;port pair. They're the same server here, which is common but not required.
  • sipCfgProxyType / sipCfgRegistrarType - the address type backing each of the above; 0 is a plain IPv4 address rather than a DNS name.
  • sipCfgSipFeatureSwitch - a bitmask of SIP feature toggles, set here as a raw hex value rather than individual named flags.
  • sipCfgProvisionedCodecArray - the codec list. PCMA and PCMU are the standard names for G.711 A-law and u-law, the two baseline uncompressed voice codecs essentially every VoIP endpoint supports.
  • sipCfgPacketizationRate - the audio packetization interval in milliseconds; 20 is the standard default for G.711.

Two lines aren't confirmed here: 4115.10.1.3.0 (an IP address, likely another infrastructure server given its position alongside the DHCP/provisioning settings) and 4115.10.1.20.0. Both sit under a different Arris enterprise branch (4115.10) from the rest of the SIP-specific settings, and that branch's own MIB wasn't identified with confidence here.

MTA-specific encoding

The docsis tool handles MTA files with the same binary as modem files, but different flags:

# Modem config file - needs a key file for the CMTS MIC
./docsis -e modem.cfg key.txt modem.bin

# MTA config file - no key file
./docsis -p mta.cfg mta.bin

PacketCable MTA files don't carry the same CMTS MIC integrity check DOCSIS modem files do, so -p takes just the config file and output file.

A note on comments: nested or malformed comments in an MTA config file don't always fail encoding the way you'd expect - in at least one reported case, the encoder accepted a file with a malformed comment structure without a clear error, silently producing an unintended result rather than refusing to encode. Keeping comments simple (one # per line, nothing nested) is the safest way to avoid this.

Both the DOCSIS modem bootfile and the MTA bootfile are typically served from the same TFTP server, but they're two separate files, referenced separately during provisioning - the CM side and the MTA side of a combined device each fetch and apply their own file independently.

Firmware upgrades

Firmware upgrades over DOCSIS are driven by four objects in DOCS-CABLE-DEVICE-MIB - point the device at a TFTP server and filename, then trigger the download by setting its admin status. This applies to both modem and MTA firmware, since the underlying MIB isn't specific to either side of the device.

This can be done two ways: baked into a bootfile so it happens automatically at next provisioning, or live with snmpset against a device that's already online.

# Live, via snmpset (assumes a read-write community already configured)
snmpset -v2c -c private 192.168.100.5 \
  1.3.6.1.2.1.69.1.3.3.0 a 10.0.0.5 \
  1.3.6.1.2.1.69.1.3.4.0 s "cm-firmware-v2.bin" \
  1.3.6.1.2.1.69.1.3.1.0 i 3
# Or baked into a bootfile
SnmpMibObject 1.3.6.1.2.1.69.1.3.3.0 IPADDRESS 10.0.0.5 /* docsDevSwServer */
SnmpMibObject 1.3.6.1.2.1.69.1.3.4.0 STRING "cm-firmware-v2.bin" /* docsDevSwFilename */
SnmpMibObject 1.3.6.1.2.1.69.1.3.1.0 INTEGER 3 /* docsDevSwAdminStatus */

After triggering either way, watch docsDevSwOperStatus to confirm the device actually picked up the request:

snmpget -v2c -c public 192.168.100.5 1.3.6.1.2.1.69.1.3.2.0

A practical note: bulk firmware pushes are one of the more disruptive things you can do to a fleet of devices - each one reboots as part of flashing new firmware. Staggering the rollout is generally safer than pushing to an entire population simultaneously, especially the first time a new firmware image is being deployed.